218009 matches found
Astra Linux – Vulnerability in librabbitmq
A vulnerability was discovered in the C AMQP client library also known as rabbitmq-c for RabbitMQ in versions up to 0.13.0. credentials can only be entered via the command line e.g., for amqp-publish or amqp-consume, and therefore they are visible to local attackers who can list processes along...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in BFCache in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially obtain user information via a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in openjdk-11
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Swing. The supported versions affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. This easily exploitable vulnerability allows an unauthenticated...
Astra Linux – Vulnerability in binutils
A vulnerability was discovered in cp-demangle.c of GNU libiberty, as part of GNU Binutils 2.31. There is a stack consumption vulnerability caused by infinite recursion in the functions nextistypequal and cplusdemangletype in cp-demangle.c. Remote attackers could exploit this vulnerability to caus...
Astra Linux – Vulnerability in Spice
A flaw was discovered in the spice library in versions prior to 0.14.92. A DoS tool could make it easier for remote attackers to cause a denial of service CPU consumption by performing multiple renegotiations within a single connection...
Astra Linux – Vulnerability in exiv2
In Jp2Image::readMetadata in jp2image.cpp in Exiv2 0.27.2, an input file may lead to an infinite loop and system hangs, accompanied by high CPU consumption. Remote attackers could exploit this vulnerability to cause a denial of service by using a specially crafted file...
Astra Linux – Vulnerability in imagemagick
A vulnerability was discovered in ImageMagick, where a specially created SVG file can load itself and cause a segmentation fault. This flaw allows a remote attacker to upload a specially crafted SVG file, leading to a segmentation fault and the creation of numerous trash files in "/tmp," resultin...
Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15
Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel versions 5.1 through 5.19.x, prior to 5.19.16, could be exploited by local attackers those capable of injecting WLAN frames to trigger use-after-free conditions, potentially allowing them to execute...
Astra Linux – Vulnerability in openjdk-11
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Library. The supported versions affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM Enterprise Edition: 20.3.2 and 21.1.0. This easily exploitable vulnerability allows an...
Astra Linux – Vulnerability in Linux
In the Linux kernel up to version 5.8.7, local attackers who were able to inject conntrack netlink configurations could exploit an overflow in a local buffer, resulting in crashes or triggering the use of incorrect protocol numbers in ctnetlinkparsetuplefilter in net/netfilter/nfconntracknetlink....
PT-2026-91212
Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customer email.php. Authenticated attackers can enumerate global sender alias IDs and read other customers' allowed sender values by supplying arbitrary senderid parameters in delete confirmation requests...
CVE-2023-22632
PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the FTP Server Count Sensor...
CVE-2026-90542 WWBN AVideo Missing Authorization via remindMe.json.php
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate that logged-in users can access live schedules before creating reminders via remindMe.json.php. Authenticated attackers can create scheduler reminders for private live schedules they cannot view and learn the...
CVE-2026-18579
The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTPXFORWARDEDFOR' parameter in all versions up to, and including, 9.2.08.003 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...
CVE-2026-77150
The Unlimited Elements For Elementor plugin for WordPress (versions up to and including 2.0.16 ) is vulnerable to Reflected Cross-Site Scripting (XSS) via the data[name] parameter in the show_preview AJAX action . The root cause is insufficient input sanitization and output escaping. Notably, the...
EUVD-2026-75601
FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary code by exploiting incorrect options passed to unserialize in the Perms::getPerms method, where a positional array is used instead of the required named-key array to...
CVE-2026-88940 knowns through 0.33.0 Arbitrary Directory Enumeration via workspace browse endpoint
knowns through 0.33.0 fails to validate the path query parameter in the workspace browse endpoint, allowing remote attackers to enumerate arbitrary directories on the host filesystem. Attackers can traverse the directory structure to locate project directories and identify targets for further...
CVE-2026-88872
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the setPassword.json.php endpoint that allows unauthenticated attackers to modify any user's channel password by sending a GET request. Attackers can craft a malicious webpage tha...
CVE-2026-87747 Ragic｜Enterprise Cloud Database - Arbitrary File Read
The Enterprise Cloud Database developed by Ragic has an Arbitrary File Read vulnerability. Privileged remote attackers can exploit Relative Path Traversal to download arbitrary system files...