56163 matches found
PT-2026-30720
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive information including authentication tokens user token, user activity, client IP addresses, and server configuration details. This allows...
The vulnerability of the persistent_cache_read_entry_v3() function in the RDP client FreeRDP allows a attacker to compromise the integrity and accessibility of protected information.
The vulnerability of the persistentcachereadentryv3 function in the RDP client FreeRDP is related to buffer overflow in dynamic memory. Exploiting this vulnerability could allow an attacker to compromise the integrity and accessibility of protected information...
The vulnerability of the rts_read_auth_verifier_no_checks() function in the RDP client FreeRDP, which allows a intruder to cause a service failure.
The vulnerability of the rtsreadauthverifiernochecks function in the FreeRDP client is related to the insufficient use of the assert function. Exploiting this vulnerability could allow a malicious actor to cause service failures...
Linux Distros Unpatched Vulnerability : CVE-2026-31392
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: fix krb5 mount with username option Customer reported that some of their krb5 mounts were failing against a single server as the client was trying ...
FileZilla 日志信息泄露漏洞
FileZilla is an open-source FTP/SFTP client for the Windows platform, developed by FileZilla. Version 3.40.0 of FileZilla contains a vulnerability related to log information disclosure. This vulnerability stems from a denial-of-service vulnerability in the local search function, which could allow...
Triggering and Detecting Exploitable Library Vulnerability from the Client by Directed Greybox Fuzzing
Developers utilize third-party libraries to improve productivity, which also introduces potential security risks. Existing approaches generate tests for public functions to trigger library vulnerabilities from client programs, yet they depend on proof-of-concepts PoCs, which are often unavailable...
Fedora 42 : bind9-next (2026-bcc66a29da)
The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-bcc66a29da advisory. Update to 9.21.20 rhbz2440560 Security Fixes: - Fix unbounded NSEC3 iterations when validating referrals to unsigned delegations. CVE-2026-1519 - Fi...
Exploit for Download of Code Without Integrity Check in Trueconf
🔓 CVE-2026-3502 - TrueConf Client Update Hijacking Exploit !...
tomcat: Client certificate verification bypass due to virtual host mapping
A certificate validation flaw has been found in Apache Tomcat. omcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one ...
Information Exposure
Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Information Exposure via the client.log.php endpoint, which serves operational log files without enforcing authentication. An attacker can obtain sensitive interna...
@budibase/backend-core (>=3.0.0, <=3.2.26), @budibase/bbui (>=3.0.0, <=3.2.26) +6 more potentially affected by CVE-2026-35216 via @budibase/shared-core (>=3.0.0, <=3.2.26)
@budibase/shared-core NPM version =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.2.26 Source cves: CVE-2026-35216 Source advisory: SNYK:JS-BUDIBASESHAREDCORE-15917499...
CVE-2026-35616
A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests...
CVE-2026-34773
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, on Windows, app.setAsDefaultProtocolClientprotocol did not validate the protocol name before writing to the registry. Apps that pass...
PT-2026-30336
Name of the Vulnerable Software and Affected Versions AVideo versions 26.0 and prior Description The plugin/CloneSite/client.log.php endpoint serves the clone operation log file without authentication. Other endpoints in the CloneSite plugin directory enforce User::isAdmin. The log contains...
7 Tik 安全漏洞
7 Tik is an unofficial TikTok client developed by 7 Tik Company. Version 7 Tik 1.0.1.0 contains a security vulnerability. This vulnerability arises from the search function’s improper handling of extremely long input strings, which could allow attackers to cause the application to crash by...
CVE-2026-34773 Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, on Windows, app.setAsDefaultProtocolClientprotocol did not validate the protocol name before writing to the registry. Apps that pass...
CVE-2026-34773 Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, on Windows, app.setAsDefaultProtocolClientprotocol did not validate the protocol name before writing to the registry. Apps that pass...
CVE-2026-34773
CVE-2026-34773 (Electron, Windows): The issue arises when calling app.setAsDefaultProtocolClient() with a protocol name derived from external input; the protocol name is written to HKCU\Software\Classes\ without proper validation, risking hijack of existing protocol handlers. Affected Electron ve...
