CVE-2026-26050

CVE-2026-26050 affects the installer for ジョブログ集計/分析ソフトウェア RICOHジョブログ集計ツール prior to version 1.3.7 . The issue is in the DLL search path which may cause insecure loading of Dynamic Link Libraries, enabling arbitrary code execution with administrative privileges . CVSS metrics from JPCERT quantify t...

bn.js affected by an infinite loop

This affects versions of the package bn.js before 4.12.3 and 5.2.3. Calling maskn0 on any BN instance corrupts the internal state, causing toString, divmod, and other methods to enter an infinite loop, hanging the process indefinitely...

CVE-2026-2739

This affects versions of the package bn.js before 5.2.3. Calling maskn0 on any BN instance corrupts the internal state, causing toString, divmod, and other methods to enter an infinite loop, hanging the process indefinitely...

CVE-2026-2739

CVE-2026-2739 affects bn.js versions before 5.2.3. Calling maskn(0) on any BN instance corrupts internal state, causing toString(), divmod(), and related methods to enter an infinite loop and hang the process. The Snyk/NVD/CVE listings confirm the impact and provide examples; the recommended reme...

CVE-2025-15585

Fileflows versions before 25.05.2 are affected by an authenticated SQL injection vulnerability in the library-file search function. Successful exploitation requires the system to use MySQL as the underlying database and could result in privilege escalation or data exfiltration...

CVE-2025-15581

Orthanc versions before 1.12.10 are affected by an authorisation logic flaw in the application's HTTP Basic Authentication implementation. Successful exploitation could result in Privilege Escalation, potentially allowing full administrative access...

CVE-2025-30416

CVE-2025-30416 affects Acronis Cyber Protect 16 (Linux/Windows) prior to build 39938 and Cyber Protect 15 prior to build 41800. The described issue is missing authorization that allows sensitive data disclosure and manipulation, with a CVSS v3.0 score of 10.0 (CRITICAL) and network attack vector,...

CVE-2025-30412

Sensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 Linux, Windows before build 39938, Acronis Cyber Protect 15 Linux, Windows before build 41800...

CVE-2025-30412

Sensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 Linux, Windows before build 39938, Acronis Cyber Protect 15 Linux, Windows before build 41800...

CVE-2025-30412

The CVE-2025-30412 entry concerns a sensitive data disclosure and manipulation due to improper authentication affecting Acronis Cyber Protect 16 (Linux, Windows) before build 39938 and Acronis Cyber Protect 15 (Linux, Windows) before build 41800. The vulnerability involves failure to enforce auth...

CVE-2025-30411

CVE-2025-30411 affects Acronis Cyber Protect 16 (Linux/Windows) before build 39938 and Cyber Protect 15 before build 41800. The issue arises from improper authentication, enabling sensitive data disclosure and manipulation. CVSS v3.0 base score 10.0 (CRITICAL), attack vector NETWORK, no privilege...

SUSE CVE-2026-2648

Heap buffer overflow in PDFium in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to perform an out of bounds memory write via a crafted PDF file. Chromium security severity: High...

PT-2026-21065

Name of the Vulnerable Software and Affected Versions BoldThemes Travelicious versions prior to 1.6.7 Description The software contains a flaw due to deserialization of untrusted data, which allows for object injection. This could potentially allow an attacker to manipulate serialized data and...

WordPress plugin Nestin 代码问题漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. Versions...

WordPress plugin PatioTime 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

SolarWinds Database Performance Analyzer < 2025.3 Hard-coded Cryptographic Key (CVE-2025-26398)

According to its self-reported version, the SolarWinds Database Performance Analyzer DPA installation on the remote host is prior to 2025.3. It is, therefore, affected by a hard-coded cryptographic key vulnerability. If exploited, this vulnerability could allow a machine-in-the-middle MITM attack...

CVE-2025-67438

A Stored Cross-Site Scripting XSS vulnerability in Sync-in Server before 1.9.3 allows an authenticated attacker to execute arbitrary JavaScript in a victim's browser. By uploading a crafted SVG file containing a malicious payload, an attacker can access and exfiltrate sensitive information,...

PT-2026-21285

Name of the Vulnerable Software and Affected Versions PROLiNK PRC2402M versions prior to 2021-06-13 Description The PROLiNK PRC2402M router firmware contains a flaw that allows for arbitrary OS command execution. The issue resides in the live api.cgi script when handling the page=satellite list...

Slyde 安全漏洞

Slyde is an animation demonstration program developed by Tygo van den Hurk personally. Versions of S Clyde prior to 0.0.4 contained security vulnerabilities. These vulnerabilities stemmed from Node.js automatically importing the plugin.js file from the nodemodules directory, which could allow...

LibreNMS 跨站脚本漏洞

LibreNMS is an open-source network monitoring system developed by the LibreNMS community, based on PHP and MySQL. This system features custom alerts, automatic discovery of networks, and automatic updates. Versions of LibreNMS prior to 25.12.0 contained a cross-site scripting vulnerability. This...