14393 matches found
EulerOS Virtualization 2.12.1 (EulerOS-SA-2026-2762)
According to the versions of the packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation...
PT-2026-62994
Name of the Vulnerable Software and Affected Versions Oracle GoldenGate versions 23.4 through 23.26.2 Description A flaw in the Config Service Executable allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation can lead to a full takeover o...
PT-2026-62156
Name of the Vulnerable Software and Affected Versions Oracle Enterprise Manager Base Platform version 13.5 Oracle Enterprise Manager Base Platform version 24.1 Description An issue exists in the Enterprise Config Management component of the Oracle Enterprise Manager Base Platform. A low privilege...
PT-2026-63318
Name of the Vulnerable Software and Affected Versions AccountsService versions prior to 23.13.9-8ubuntu7 Description An Ubuntu-specific patch in the SetLanguage function only partially drops privileges before launching language helper scripts. While the effective UID/GID is changed to the target...
CVE-2026-46991: Improper Access Control
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Enterprise Config Management. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where...
CVE-2026-46990: Improper Access Control
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Enterprise Config Management. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...
CVE-2026-46992: Missing Authentication for Critical Function
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Enterprise Config Management. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to...
Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning
Summary Axios’ Node.js HTTP adapter can route requests through an attacker-controlled proxy when Object.prototype.proxy is polluted and request configuration is materialized as a regular object before dispatch. Recent axios releases harden merged request config by creating a null-prototype object...
GHSA-GCFJ-64VW-6MP9 Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning
Summary Axios’ Node.js HTTP adapter can route requests through an attacker-controlled proxy when Object.prototype.proxy is polluted and request configuration is materialized as a regular object before dispatch. Recent axios releases harden merged request config by creating a null-prototype object...
Prototype Pollution
Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution in the bodyless method aliases in lib/core/Axios.js, the proxy handling in lib/adapters/http.js, and the paramsSerializer read in...
BIT-NGINX-AGENT-2026-60062 NGINX Agent Vulnerability
The NGINX Agent configdirs directive allows a low-privileged attacker to gain limited read and write access to files outside of the designated secure directory. The configdirs directive required for this issue can also be configured through NGINX Instance Manager. A successful exploit may allow a...
GHSA-XJ6Q-8X83-JV6G Axios: Prototype pollution auth subfields can inject Basic auth
Summary Axios versions after the GHSA-q8qp-cvcw-x6jj fix still contain prototype-pollution read-side gadgets in Basic auth subfield handling. If a host application is already affected by prototype pollution and then makes an axios request with an own auth object that omits username or password,...
CVE-2026-35048
The CVE affects the Piwigo installer (versions 16.3.0 and earlier) where POST parameters for database configuration are written directly into local/config/database.inc.php without proper sanitization. The issue arises because on PHP 8+, addslashes() no longer provides protection after get_magic_q...
axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution
A flaw was found in Axios. This vulnerability, a Prototype Pollution "Gadget" attack, allows an attacker to escalate any existing Object.prototype pollution in an application's dependency tree into a full Man-in-the-Middle MITM attack. This enables the attacker to intercept, read, and modify all...
CVE-2026-12484
A flaw was found in Keras, specifically within the keras.layers.TorchModuleWrapper.fromconfig method. This vulnerability allows an attacker to perform unsafe deserialization of PyTorch pickle data. By processing untrusted Keras layer configurations, a local attacker could exploit this flaw, leadi...
CVE-2026-13156
The MailerSend WordPress plugin before 1.0.8 does not perform a nonce check on its configuration-delete action it verifies the manageoptions capability but ignores the nonce, so an attacker can trick a logged-in administrator into visiting a crafted page that wipes the MailerSend WordPress plugin...
CVE-2026-13156
The MailerSend WordPress plugin before 1.0.8 does not perform a nonce check on its configuration-delete action it verifies the manageoptions capability but ignores the nonce, so an attacker can trick a logged-in administrator into visiting a crafted page that wipes the MailerSend WordPress plugin...
PT-2026-67419
Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.53 Description Improper escaping of section names in git config files allows the injection of arbitrary configuration directives through malicious submodule names. By utilizing the create submodule or clone from...
The vulnerability of the TorchModuleWrapper.from_config() function in the Keras library allows a hacker to execute arbitrary code.
The vulnerability of the TorchModuleWrapper.fromconfig function in the Keras library is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow an attacker to execute arbitrary code...