18005 matches found
EUVD-2026-62525
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...
CVE-2026-76238
stigmem versions before 0.9.0a12 contain a broken object level authorization vulnerability in the decay sweep endpoint that allows authenticated attackers with write credentials for one tenant to execute decay operations affecting all tenants. Attackers can submit POST requests to the decay sweep...
EUVD-2026-62478
stigmem versions before 0.9.0a12 contain a broken object level authorization vulnerability in the decay sweep endpoint that allows authenticated attackers with write credentials for one tenant to execute decay operations affecting all tenants. Attackers can submit POST requests to the decay sweep...
CVE-2026-76225 ArcadeDB before 26.8.1 Server-Side Request Forgery via LOAD CSV
ArcadeDB before 26.8.1 contains a server-side request forgery vulnerability in the OpenCypher LOAD CSV implementation that fails to validate HTTP/HTTPS URLs. Authenticated attackers can craft LOAD CSV queries pointing to internal network addresses or cloud metadata endpoints to make the ArcadeDB...
CVE-2026-18372
CSS injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated vault administrator to inject arbitrary CSS, affecting the web user interface displayed to other vault users...
CVE-2026-18371
HTML injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated attacker to affect web user interface contents displayed to other users...
CVE-2026-18371 HTML injection in M-Files Web
HTML injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated attacker to affect web user interface contents displayed to other users...
EUVD-2025-210740
The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress is vulnerable to unauthorized access of data due to a improper capability check on the canaccess function in all versions up to, and including, 1.9.15. This makes it possible for authenticated attackers, with...
CVE-2026-18371: Improper Neutralization of Input During Web Page Generation
HTML injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated attacker to affect web user interface contents displayed to other users...
PT-2026-78580
Tapo C100/C101 V5 contains a heap-based buffer overflow vulnerability in the RTSP service. An authenticated attacker on the local network can send specially crafted RTSP frame data containing oversized length values, resulting in out-of-bounds heap writes. Successful exploitation can crash the RT...
CVE-2026-15421: Improper Neutralization of Input During Web Page Generation
The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes in all versions up to, and including, 7.8.0 due to insufficient input sanitization and output escaping. This makes it possible for...
PT-2026-78464
Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 and 7.3 IBM PowerVM VIOS version 4.1 Description Remote authenticated attackers can execute arbitrary commands due to improper neutralization of special elements used in an OS command. This issue occurs when the system fai...
PT-2026-78666
Name of the Vulnerable Software and Affected Versions IBM AIX version 7.2 IBM AIX version 7.3 IBM PowerVM VIOS version 4.1 Description A stack buffer overflow allows a remote authenticated attacker to execute arbitrary code. A stack buffer overflow occurs when a program writes more data to a buff...
CVE-2026-18102: Heap-based Buffer Overflow
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to overwrite adjacent memory due to an integer underflow during bounds checking...
CVE-2026-17015: Out-of-bounds Read
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service and obtain sensitive information due to an out-of-bounds read...
PT-2026-78420
Name of the Vulnerable Software and Affected Versions Stigmem versions prior to 0.9.0a11 Description Authenticated users can perform blind Server-Side Request Forgery SSRF attacks by specifying internal loopback or private network destinations in the delivery address parameter during the creation...
PT-2026-78700
Name of the Vulnerable Software and Affected Versions Coturn version 4.15.0 Description An authenticated TURN user can repeatedly resume a single allocation from new UDP 5-tuples without completing a handoff when the server has the --mobility feature enabled. This occurs because the mobile begin...
PT-2026-78326
Name of the Vulnerable Software and Affected Versions M-Files Web versions prior to 26.8.16330.2 Description An authenticated vault administrator can inject arbitrary CSS into the web user interface. This allows the administrator to modify the visual presentation of the interface as displayed to...
PT-2026-78436
OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the patient portal template import handler that allows authenticated attackers with Forms Administration permissions to upload template files containing arbitrary HTML or JavaScript. Attackers can inject malicious script...