3379 matches found
CVE-2026-22237
The vulnerability exists in BLUVOYIX due to the exposure of sensitive internal API documentation. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the APIs exposed by the documentation. Successful exploitation of this vulnerability...
CVE-2026-22239 Email Sending Vulnerability in BLUVOYIX
The vulnerability exists in BLUVOYIX due to design flaws in the email sending API. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable email sending API. Successful exploitation of this vulnerability could allow the...
CVE-2026-22237 Exposed Internal API Documentation Vulnerability in BLUVOYIX
The vulnerability exists in BLUVOYIX due to the exposure of sensitive internal API documentation. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the APIs exposed by the documentation. Successful exploitation of this vulnerability...
CVE-2026-22237
Technical details (affected products/versions/patch information) are not publicly provided in the supplied documents. Monitor for updates from the cited sources and Red Hat/EUVD/CVELIST entries for concrete details.
CVE-2026-22237 Exposed Internal API Documentation Vulnerability in BLUVOYIX
The vulnerability exists in BLUVOYIX due to the exposure of sensitive internal API documentation. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the APIs exposed by the documentation. Successful exploitation of this vulnerability...
CVE-2026-22236 Improper Authentication Vulnerability in BLUVOYIX
The vulnerability exists in BLUVOYIX due to improper authentication in the BLUVOYIX backend APIs. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable APIs. Successful exploitation of this vulnerability could allow the...
Denial-of-Service (DoS)
Marshmallow is vulnerable to a Denial-Of-Service DoS. The vulnerability is due to inefficient processing in Schema.loaddata, many=True, where moderately sized inputs can trigger excessive CPU consumption, allowing attackers to degrade service availability through crafted requests...
GHSA-R7VR-WG3F-8HR9 Concrete5 CMS contains an XPath injection vulnerability
Concrete5 CMS version 9.1.3 contains an XPath injection vulnerability that allows attackers to manipulate URL path parameters with malicious payloads. Attackers can flood the system with crafted requests to potentially extract internal content paths and system information...
EUVD-2025-206286
NSecsoft 'NSecKrnl' is a Windows driver that allows a local, authenticated attacker to terminate processes owned by other users, including SYSTEM and Protected Processes by issuing crafted IOCTL requests to the driver...
PT-2026-2924
Name of the Vulnerable Software and Affected Versions Tenda AX-1806 version 1.0.0.1 Description The Tenda AX-1806 router contains a stack overflow issue in the serverName parameter of the sub 65A28 function. A crafted request can trigger a Denial of Service DoS. Recommendations Update to a newer...
MiracleLinux 3 : httpd-2.2.3-22.2.1AXS3 (AXSA:2009-77:02)
The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2009-77:02 advisory. The Apache HTTP Server is a powerful, efficient, and extensible web server. Fixed bugs: CVE-2009-1890 The streamreqbodycl function in modproxyhttp.c i...
PT-2026-2859
The vulnerability exists in BLUVOYIX due to improper authentication in the BLUVOYIX backend APIs. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable APIs. Successful exploitation of this vulnerability could allow the...
MiracleLinux 4 : dhcp-4.1.1-25.P1.AXS4.1 (AXSA:2012-49:01)
The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2012-49:01 advisory. DHCP Dynamic Host Configuration Protocol is a protocol which allows individual devices on an IP network to get their own network configuration information IP...
The vulnerability of cw_acd on the local management platform FortiSwitchManager and the FortiOS operating systems allows a perpetrator to execute arbitrary commands.
The vulnerability of cwacd on the local management platform FortiSwitchManager and the FortiOS operating systems is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands by sending specially crafte...
Fortinet FortiSIEM Unauthenticated Remote Command Injection (FG-IR-25-772)
The version of Fortinet FortiSIEM running on the remote server is 6.7.x through 6.7.10, 7.0.x through 7.0.4, 7.1.x prior to 7.1.9, 7.2.x prior to 7.2.7, 7.3.x prior to 7.3.5, or 7.4.0. It is, therefore, affected by an unauthenticated remote command injection vulnerability: - An improper...
CVE-2025-47855
CVE-2025-47855 affects Fortinet FortiFone: versions 3.0.13–3.0.23 and 7.0.0–7.0.1 are vulnerable to an unauthenticated information disclosure via crafted HTTP/HTTPS requests (CWE-200). The vulnerability allows retrieval of device configuration. Remediation stated in sources: upgrade to FortiFone ...
CVE-2025-67685
Fortinet FortiSandbox is affected by CVE-2025-67685 via an SSRF flaw in versions 4.0–5.0.4 (including 4.2 and 4.4). An authenticated attacker can proxy internal plaintext endpoints by crafting HTTP requests; ZDI mentions potential remote code execution through web socket handling. Remediation: up...
CVE-2025-59922
An improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability CWE-89 vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.4, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2.0 through 7.2.10, FortiClientEMS 7.0 all versions may allow an...
CVE-2025-64155
CVE-2025-64155 is an unauthenticated remote command-injection vulnerability in Fortinet FortiSIEM (7.4.0 and multiple older branches) where crafted TCP requests can cause OS command injection. The issue stems from improper neutralization of special elements in an os command, enabling attackers to...