276770 matches found
CVE-2026-118247
Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until Dashboards 4.2.2, and from 2.0.0 until Grid Pro 3.2.0, Highcharts DataTable single-cell writers use an untrusted column ID as a key without rejecting proto or constructor. DataTable.setCell, including Dashboards connect...
Malware in mock-transactions-sdk
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
CVE-2026-50542
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on GET /layout/status/id allow an authenticated user with any privileges to view the status and metadata of any layout, including...
CVE-2026-117609
rtl433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2mc that allows nearby attackers to write past a 7-byte stack buffer by sending more than seven valid Manchester-coded words. Attackers can transmit a crafted OOK radio signal or supply a crafted signal file to...
Malware in camelotlabs-config
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malware in camelotlabs-utils
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malware in camelotlabs-sdk
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
CVE-2026-52729
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on PUT/DELETE /action/id allow an authenticated user to modify or delete actions on any Layout. Exploitation requires the privile...
CVE-2026-59164
NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, nora-registry authenticates the token-management UI but fails to require administrator authorization. authmiddleware protects /ui/tokens and /api/ui/tokens, but state-changing requests are checked only with...
CVE-2026-50541
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on GET /dataset/export/csv/id allow an authenticated user to export data from any dataset, including datasets created by...
CVE-2026-50541
The Xibo open source digital signage platform is vulnerable to an IDOR (Broken Object-Level Authorization) flaw in versions prior to 4.4.3 . The root cause is missing access-control checks on the GET /dataset/export/csv/{id} endpoint, which allows an authenticated user to export data from any dat...
EUVD-2026-112086
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on GET /dataset/export/csv/id allow an authenticated user to export data from any dataset, including datasets created by...
CVE-2026-52729
The Xibo open source digital signage platform is vulnerable to an IDOR (Broken Object-Level Authorization) flaw in versions prior to 4.4.3 . Missing access-control checks on PUT/DELETE /action/{id} allow an authenticated user to modify or delete actions on any Layout. While the vulnerability is t...
CVE-2026-67073
HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Control vulnerability. This could allow an attacker to upload malicious or unauthorized files and directly access or download sensitive uploaded content, potentially leading to information disclosure, unauthorized acces...
CVE-2026-116393
Missing Authorization vulnerability in iHomefinder, Inc. Optima Express optima-express allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Optima Express: from n/a through 9.0.0...
CVE-2026-59164
The NORA self-hosted artifact registry (versions prior to 0.9.5 ) contains a missing authorization vulnerability in the nora-registry component. While the auth_middleware() protects the token-management UI, it fails to enforce administrator authorization for state-changing requests, checking only...
CVE-2026-59164
NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, "nora-registry" authenticates the token-management UI but fails to require administrator authorization. "authmiddleware" protects "/ui/tokens" and "/api/ui/tokens", but state-changing requests are checked only with...
CVE-2026-116393 WordPress Optima Express + MarketBoost IDX Plugin plugin <= 8.7.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in iHomefinder, Inc. Optima Express optima-express allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Optima Express: from n/a through 9.0.0...
CVE-2026-116393 WordPress Optima Express + MarketBoost IDX Plugin plugin <= 8.7.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in iHomefinder, Inc. Optima Express optima-express allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Optima Express: from n/a through 9.0.0...