458289 matches found
Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: rsync (UTSA-2026-130076)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130076 advisory. rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink...
VulnCheck KEV: CVE-2026-103671
External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin for EC-CUBE 4 series "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained...
PT-2026-113672
Name of the Vulnerable Software and Affected Versions File Upload to Order versions prior to 1.1.4 Description An issue exists where the plugin fails to validate or confine a file path derived from attacker-controlled session data before performing a file deletion. This action can be triggered by...
PT-2026-113639
Improper neutralization of special elements in the NetBird client SSH configuration manager client/ssh/config/manager.go in NetBird versions 0.60.0 through 0.74.6 allows a malicious or compromised peer to execute arbitrary commands on other NetBird client hosts. The client writes a system-wide...
Linux Distros Unpatched Vulnerability : CVE-2026-110162
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Desktop in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...
Linux Distros Unpatched Vulnerability : CVE-2026-110164
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted...
Linux Distros Unpatched Vulnerability : CVE-2026-110157
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...
CVE-2026-110002: Unrestricted Upload of File with Dangerous Type
The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.5 via the file scope function. This is due to missing WordPress bootstrap, authentication, capability, and nonce checks in the standalone save-to-cache.php script,...
CVE-2026-87855: Unrestricted Upload of File with Dangerous Type
The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.3 via the saveImage function. This is due to the startSession function accepting an empty jtlauth parameter as a valid credential, combined with insufficient fil...
PT-2026-113688
The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database...
CVE-2026-110445: Improper Control of Generation of Code
TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into interacting with crafted content to inject and execute arbitrary JavaScript. After the user confirms a Windows security warning, attackers can execute...
CVE-2026-92817: Incorrect Authorization
The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vision project could provide their valid Vision session identifier and gain Designer-level privileges. An attacker could exploit these...
Cisco Secure Email Gateway Relative Path Traversal Vulnerability
Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system...
Palo Alto Networks PAN-OS Code Injection Vulnerability
Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall...
DHCP Server Windows Code Execution
The vulnerability of DHCP servers for Windows operating systems is related to the use of memory after it has been freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...
DHCP Server Windows Code Execution
The vulnerability of the DHCP server for Windows operating systems is related to a memory reallocation error. Exploiting this vulnerability could allow an attacker to execute arbitrary code remotely...
Microsoft Office Memory Use After Free
The vulnerability of Microsoft Office packages and 365 Apps for Enterprise lies in the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
Windows DHCP Client Code Execution
The vulnerability of DHCP clients of Windows operating systems is related to the use of memory after it has been freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
Microsoft Office Memory Use After Free
The vulnerability of Microsoft Office packages and 365 Apps for Enterprise lies in the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
CVE-2026-85714: Improper Control of Generation of Code
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.13.2, an authenticated administrator using the default H2 database and security mode can upload a crafted SQL file to POST /api/v1/database/import-database...