14029 matches found
nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw
A flaw in the Node.js Permission Model allows attackers to bypass --permission restrictions, enabling unauthorized read or write access to files and directories...
SUSE-SU-2026:3406-1 Security update for java-17-openjdk
This update for java-17-openjdk fixes the following issues: Upgrade to upstream tag jdk-17.0.20+8 July 2026 CPU. Security issues fixed: - CVE-2026-41254: lcms: information disclosure and denial of service via integer overflow in CubeSize bsc1264994. - CVE-2026-46917: unauthenticated attacker with...
CVE-2026-4604
The Klubraum Membership Request plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the krmrstoresettings function in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to update the plugin's...
CVE-2026-7769
CVE-2026-7769 affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (versions 6.2.0.0–6.2.0.5_2, 6.2.1.0–6.2.1.1_2, 6.2.2.0–6.2.2.0_1). Root cause: SQL injection in the backend database interface. Impact: remote attacker could view, add, modify, or delete data in the back-end DB. CVSS...
WordPress English Admin <1.5.2 - Open Redirect Detection
WordPress English Admin plugin before 1.5.2 contains an open redirect vulnerability. The plugin does not validate the admincustomlanguagereturnurl before redirecting users to it. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized operations...
Dapr Dashboard 0.1.0-0.10.0 - Improper Access Control Detection
Dapr Dashboard 0.1.0 through 0.10.0 is susceptible to improper access control. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized operations. !/usr/bin/env python3 -- coding: utf-8 -- """Dapr Dashboard 0.""" from kittysploit import from...
D-Link DIR-615 - Unauthorized Access Detection
D-Link DIR-615 devices with firmware 20.06 are susceptible to unauthorized access. An attacker can access the WAN configuration page wan.htm without authentication, which can lead to disclosure of WAN settings, data modification, and/or other unauthorized operations. !/usr/bin/env python3 --...
BigAnt Server 5.6.06 - Improper Access Control Detection
BigAnt Server 5.6.06 is susceptible to improper access control. The software utililizes weak password hashes. An attacker can craft a password hash and thereby possibly possibly obtain sensitive information, modify data, and/or execute unauthorized operations. !/usr/bin/env python3 -- coding: utf...
Free5gc 3.2.1 - Information Disclosure Detection
Free5gc 3.2.1 is susceptible to information disclosure. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized operations. !/usr/bin/env python3 -- coding: utf-8 -- """Free5gc 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclie...
IceWarp - Open Redirect Detection
IceWarp open redirect vulnerabilities were detected. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. !/usr/bin/env python3 -- coding: utf-8 -- """IceWarp open redirect vulnerabilities were...
ThinkPHP 5.0.23 - Remote Code Execution Detection
ThinkPHP 5.0.23 is susceptible to remote code execution. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. !/usr/bin/env python3 -- coding: utf-8 -- """ThinkPHP 5.""" from...
Citrix ADC and Citrix NetScaler Gateway - Remote Code Injection Detection
Citrix ADC and NetScaler Gateway are susceptible to remote code injection. An attacker can potentially execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. Affected versions are before 13.0-58.30,...
Odoo 8.0/9.0/10.0 - Local File Inclusion Detection
Odoo 8.0, 9.0, and 10.0 are susceptible to local file inclusion via tools.fileopen. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. !/usr/bin/env python3 -- coding: utf-8 -- """Odoo...
Zeit Next.js < 4.2.3 - Local File Inclusion Detection
Zeit Next.js before 4.2.3 is susceptible to local file inclusion under the /next request namespace. An attacker can obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. !/usr/bin/env python3 -- coding: utf-8 -- """Ze...
Security update for java-25-openjdk
This update for java-25-openjdk fixes the following issues: Update to upstream tag jdk-25.0.4+7 July 2026 CPU. Security issues fixed: CVE-2026-41254: lcms: information disclosure and denial of service via integer overflow in CubeSize bsc1264994. CVE-2026-46917: unauthenticated attacker with netwo...
Linux CIFS File System Buffer Overflow DoS
The vulnerability of the CIFS file system modules such as fs/cifs/cifsdebug.c, fs/cifs/cifsdebug.h, fs/cifs/connect.c, and fs/cifs/sess.c in the Linux operating system is related to the reutilization of previously freed memory. Exploiting this vulnerability allows a remote attacker to compromise...
Oracle MySQL J Connector (July 2026 CPU)
The 9.7.x versions of MySQL Connector/J installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/J. Supported versions that are affected are 9.7.0-9.7.1...
CVE-2026-66824 Stored Cross-Site Scripting via Unsafe Capture Tree JSON Embedding
A stored cross-site scripting vulnerability existed in the capture tree visualization page. The application embedded the serialized capture tree directly into an inline JavaScript block using the Jinja safe filter. Because the tree data can contain values derived from captured and potentially...
Linux Distros Unpatched Vulnerability : CVE-2026-61096
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Pluggable Auth. Supported versions that are affected are MySQL Serve...
