216182 matches found
CVE-2026-25937 GLPI has a MFA bypass
GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, a malicious actor with knowledge of a user's credentials can bypass MFA and steal their account. Version 11.0.6 fixes the issue...
USN-8094-2: Linux kernel vulnerabilities
Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module LSM. An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information kernel memory, local...
EUVD-2026-12614
The Angeet ES3 KVM does not properly sanitize user-supplied variables parsed by the 'cfg.lua' script, allowing an authenticated attacker to execute OS-level commands...
CVE-2026-2579
The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the ‘search’ parameter in all versions up to, and including, 4.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing S...
Wazuh 资源管理错误漏洞
Wazuh is an open-source application developed by Wazuh. It is used for collecting, summarizing, indexing, and analyzing security data, helping organizations detect intrusions, threats, and abnormal behaviors. Versions of Wazuh from 4.3.0 to 4.14.3 contained a resource management vulnerability. Th...
PT-2026-25903
Name of the Vulnerable Software and Affected Versions Perle IOLAN STS/SCS versions prior to 6.0 Description Perle IOLAN STS/SCS terminal server models with firmware versions prior to 6.0 allow authenticated operating system command injection through the restricted shell accessible via Telnet or...
ANGEET ES3 KVM 安全漏洞
ANGEET ES3 KVM is a KVM switch device from theANGEET company that enables remote control of keyboards, video, and mice through the network. The ANGEET ES3 KVM has a security vulnerability; this vulnerability stems from allowing remote, unauthenticated attackers to write arbitrary files, potential...
Atlassian Bamboo Data Center 安全漏洞
Atlassian Bamboo Data Center is a continuous integration and delivery server software developed by the Australian company Atlassian. Vulnerabilities exist in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Atlassian Bamboo Data Center. These vulnerabilities stem from...
Google Chrome WebView Resource Management Error Vulnerability
Google Chrome is a free web browser developed by Google Inc. A security vulnerability exists in Google Chrome WebView that originates from re-referencing or using freed memory, which can be exploited by remote attackers to execute arbitrary code...
Adobe Commerce Security Bypass Vulnerability (CNVD-2026-16579)
Adobe Commerce is the United States of America Odobie Adobe company's a kind of merchants and brands for the world's leading digital commerce solutions. A security bypass vulnerability exists in Adobe Commerce, which can be exploited by an attacker to cause a security feature bypass...
libsoup 安全漏洞
Libsoup is a GNOME project’s HTTP client/server library. Libsoup has a security vulnerability, which stems from a reuse of freed resources in the implementation of HTTP/2 servers. This vulnerability could allow remote attackers to exploit it by sending specially crafted HTTP/2 requests, resulting...
PT-2026-25944
Edimax GS-5008PL firmware version 1.00.54 and prior use cleartext HTTP for the web management interface without implementing TLS or SSL encryption. Attackers on the same network can intercept management traffic to capture administrator credentials and sensitive configuration data...
EUVD-2026-12494
Buffalo TeraStation NAS TS5400R firmware version 4.02-0.06 and prior contain an excessive file permissions vulnerability that allows authenticated attackers to read the /etc/shadow file by uploading and executing a PHP file through the webserver. Attackers can exploit world-readable permissions o...
EUVD-2025-208767
A write-what-where condition in p2r3 Bareiron commit 8e4d40 allows unauthenticated attackers to write arbitrary values to memory, enabling arbitrary code execution via a crafted packet...
EUVD-2026-12458
Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary JavaScript by manipulating the Device Name field. Attackers can inject malicious scripts through the System Status interface that execut...
CVE-2026-29513
CVE-2026-29513 describes a stored XSS in Hereta ETH-IMC408M firmware ≤1.0.15. An authenticated attacker can inject JavaScript through the Device Location field via the System Status interface, with scripts executing in browsers of users viewing the status page. The CVSS 4.0 metrics indicate Netwo...
EUVD-2026-12188
Vulnogram 1.0.0 contains a stored cross-site scripting vulnerability in comment hypertext handling that allows attackers to inject malicious scripts. Remote attackers can inject XSS payloads through comments to execute arbitrary JavaScript in victims' browsers...
Vulnogram contains a stored cross-site scripting vulnerability in comment hypertext handling
Vulnogram 1.0.0 contains a stored cross-site scripting vulnerability in comment hypertext handling that allows attackers to inject malicious scripts. Remote attackers can inject XSS payloads through comments to execute arbitrary JavaScript in victims' browsers...