26374 matches found
CVE-2026-36500
The OpenDaylight Controller (v12.0.5) is vulnerable to a directory traversal (path traversal) flaw in the cluster-admin:backup-datastore component. The root cause is the lack of validation on the user-controlled filePath argument of the BackupDatastoreCommand, which is passed directly into the fi...
CVE-2026-36501
The OpenDaylight Controller (specifically version 12.0.5) is vulnerable to a Denial of Service (DoS) attack due to improper input validation in the Externalizable.readExternal() component. The root cause is the Allocation of Resources Without Limits or Throttling , where the readExternal() method...
CVE-2026-36501
An issue in the Externalizable.readExternal component of Controller v12.0.5 allows attackers to cause a Denial of Service DoS via a crafted input...
EUVD-2026-34867
An issue in the Externalizable.readExternal component of Controller v12.0.5 allows attackers to cause a Denial of Service DoS via a crafted input...
EUVD-2026-34866
An issue in the cluster-admin:backup-datastore component of Controller v12.0.5 allows attackers to execute a directory traversal via a crafted request...
CVE-2026-36501: Improper Input Validation
An issue in the Externalizable.readExternal component of Controller v12.0.5 allows attackers to cause a Denial of Service DoS via a crafted input...
CVE-2025-59174: Improper Handling of Syntactically Invalid Structure
Ericsson Packet Core Controller PCC versions prior to 1.39 contain a vulnerability where an attacker sending a large volume of specially crafted messages may cause service degradation...
CVE-2026-36501
An issue in the Externalizable.readExternal component of Controller v12.0.5 allows attackers to cause a Denial of Service DoS via a crafted input...
CVE-2026-36500
An issue in the cluster-admin:backup-datastore component of Controller v12.0.5 allows attackers to execute a directory traversal via a crafted request...
PT-2026-47009
An issue in the cluster-admin:backup-datastore component of Controller v12.0.5 allows attackers to execute a directory traversal via a crafted request...
CVE-2026-36501
An issue in the Externalizable.readExternal component of Controller v12.0.5 allows attackers to cause a Denial of Service DoS via a crafted input...
Arcadia Crafty Controller security vulnerabilities
Arcadia Crafty Controller is a server management panel developed under the open-source Crafty Controller project. There is a security vulnerability in Arcadia Crafty Controller. This vulnerability stems from a lack of resilience to unexpected messages from connection switches, which may lead to...
PT-2026-46957
Name of the Vulnerable Software and Affected Versions Ericsson Packet Core Controller PCC versions prior to 1.39 Description An issue exists where an attacker can cause service degradation by sending a large volume of specially crafted messages. Recommendations Update to version 1.39 or later...
CVE-2026-36500
An issue in the cluster-admin:backup-datastore component of Controller v12.0.5 allows attackers to execute a directory traversal via a crafted request...
PT-2026-47010
An issue in the Externalizable.readExternal component of Controller v12.0.5 allows attackers to cause a Denial of Service DoS via a crafted input...
PT-2026-47088
Name of the Vulnerable Software and Affected Versions source-controller versions prior to 1.8.5 Description Improper path handling allows for path traversal in two scenarios. First, an actor capable of influencing the contents of a bucket referenced by a Bucket resource can force the...
CVE-2026-36500: Improper Limitation of a Pathname to a Restricted Directory
An issue in the cluster-admin:backup-datastore component of Controller v12.0.5 allows attackers to execute a directory traversal via a crafted request...
CVE-2026-36500
An issue in the cluster-admin:backup-datastore component of Controller v12.0.5 allows attackers to execute a directory traversal via a crafted request...
Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts
UserController::upsertUser writes user data in SYSTEMSCOPE and does not filter the admin field. A non-admin API user with user:create or user:update ACL permission can set admin: true on new or existing users, escalating to full admin access. The Problem In...
