463826 matches found
CVE-2026-55836
The Open Zaak data and services layer is vulnerable to path traversal and arbitrary server-file read in versions 1.13.0 through 1.27.2, 1.28.2, and 1.29.0. The root cause lies in the _import_document_row function within src/openzaak/components/documenten/tasks.py, which fails to validate that the...
CVE-2026-55836 Open Zaak: Path traversal / arbitrary server-file read via Documenten API document import (bestandspad)
Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.13.0 until 1.27.2, 1.28.2, and 1.29.0, importdocumentrow in src/openzaak/components/documenten/tasks.py uses the attacker-controlled bestandspad CSV field without ensuring that the resolved path remains...
CVE-2026-55836 Open Zaak: Path traversal / arbitrary server-file read via Documenten API document import (bestandspad)
Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.13.0 until 1.27.2, 1.28.2, and 1.29.0, importdocumentrow in src/openzaak/components/documenten/tasks.py uses the attacker-controlled bestandspad CSV field without ensuring that the resolved path remains...
CVE-2026-95182
An untrusted search path in DeepSeek Harness dsh commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content...
CVE-2026-88755
Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary code via opening a crafted repository...
CVE-2026-111728
Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper authorization, allowing unauthenticated LAN or Tailnet clients to bypass the privileged mediastream settings guard by setting transcodeHwAccel to custom and supplying attacker-controlled decodeFlags...
CVE-2026-107777
Thermo Fisher Torrent Suite Software is vulnerable to a path traversal, which could allow an authenticated attacker to read arbitrary files on the Torrent Server that are accessible to the web service account...
CVE-2025-52097
Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary code via reflecting un-sanitized input from query string parameters directly into the HTML response without proper output encoding...
CVE-2026-111728
Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper authorization, allowing unauthenticated LAN or Tailnet clients to bypass the privileged mediastream settings guard by setting transcodeHwAccel to custom and supplying attacker-controlled decodeFlags...
CVE-2026-111728
Seanime versions v3.7.0 to v3.10.3 are vulnerable to an argument injection vulnerability due to improper authorization. Unauthenticated LAN or Tailnet clients can bypass the privileged mediastream settings guard by setting transcodeHwAccel to custom and providing attacker-controlled decodeFlags a...
CVE-2026-111728 Seanime v3.10.3 Argument Injection via TranscodeHwAccelCustomSettings
Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper authorization, allowing unauthenticated LAN or Tailnet clients to bypass the privileged mediastream settings guard by setting transcodeHwAccel to custom and supplying attacker-controlled decodeFlags...
CVE-2026-111728 Seanime v3.10.3 Argument Injection via TranscodeHwAccelCustomSettings
Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper authorization, allowing unauthenticated LAN or Tailnet clients to bypass the privileged mediastream settings guard by setting transcodeHwAccel to custom and supplying attacker-controlled decodeFlags...
EUVD-2026-102897
Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper authorization, allowing unauthenticated LAN or Tailnet clients to bypass the privileged mediastream settings guard by setting transcodeHwAccel to custom and supplying attacker-controlled decodeFlags...
CVE-2026-111728 Seanime v3.10.3 Argument Injection via TranscodeHwAccelCustomSettings
Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper authorization, allowing unauthenticated LAN or Tailnet clients to bypass the privileged mediastream settings guard by setting transcodeHwAccel to custom and supplying attacker-controlled decodeFlags...
Exploit for CVE-2026-92209
CVE-2026-92209 An improper authentication vulnerability in th...
CVE-2026-107777
The Thermo Fisher Torrent Suite Software is vulnerable to a path traversal vulnerability. This flaw could allow an authenticated attacker to read arbitrary files on the Torrent Server that are accessible to the web service account. While no known public exploitation has been reported, CISA recomm...
CVE-2026-107777 Thermo Fisher Torrent Suite Software Path Traversal
Thermo Fisher Torrent Suite Software is vulnerable to a path traversal, which could allow an authenticated attacker to read arbitrary files on the Torrent Server that are accessible to the web service account...
CVE-2026-107777 Thermo Fisher Torrent Suite Software Path Traversal
Thermo Fisher Torrent Suite Software is vulnerable to a path traversal, which could allow an authenticated attacker to read arbitrary files on the Torrent Server that are accessible to the web service account...
EUVD-2026-102896
Thermo Fisher Torrent Suite Software is vulnerable to a path traversal, which could allow an authenticated attacker to read arbitrary files on the Torrent Server that are accessible to the web service account...
Eval Injection
Overview sglang is a SGLang is a fast serving framework for large language models and vision language models. Affected versions of this package are vulnerable to Eval Injection via evaluatefilter, which passes attacker-controlled input to eval. A remote attacker can escape the eval sandbox by...