383888 matches found
CVE-2026-105292 Chaterm before 0.12.1 Login CSRF via chaterm:// OAuth Callback
Chaterm before 0.12.1 contains a login cross-site request forgery vulnerability that allows remote attackers to inject login state by sending chaterm:// callbacks without OAuth state validation. Attackers can trigger a crafted callback with attacker-controlled userInfo from a web page, signing th...
EUVD-2026-92470
WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. The data parameter is base64-decoded and passed directly into the string2array function in app/Module/Base.php, which executes eval"$array = $data;" whenever the decoded string starts...
EUVD-2026-92442
WookTeam v1.6.6 and before is vulnerable to a Directory Traversal. The project task export endpoint /api/project/task/export downloads an arbitrary file from the server when the data parameter is supplied with a crafted JSON payload. The file value inside the JSON is concatenated directly into...
ROS-20261005-73-0146
The vulnerability of the f81604readintcallback function in the drivers/crypto/ccp/sev-dev-tsm.c file of the Linux kernel cryptographic accelerator driver is related to insufficient logging. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality, integrity, a...
ROS-20261005-73-0133
The vulnerability of the kawethprobe function in the drivers/net/usb/kaweth.c module of the Linux USB network adapter driver framework is related to improper validation of consistency checks in input data. Exploiting this vulnerability could allow an attacker to cause service failures...
Cross-Lingual Transferability of Training Data Extraction Attacks to Recover Memorized PII
The robustness of Personally Identifiable Information PII protection in Large Language Models LLMs is a critical concern, yet the risks associated with cross-lingual data extraction remain under-explored. This study evaluates the vulnerability of English-centric and multilingual models to Trainin...
PT-2026-106073
Insertion of Sensitive Information Into Sent Data vulnerability in Etoile Web Design Incorporated Five Star Restaurant Reservations restaurant-reservations allows Retrieve Embedded Sensitive Data.This issue affects Five Star Restaurant Reservations: from n/a through 2.7.24...
CVE-2026-88393
WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. The data parameter is base64-decoded and passed directly into the string2array function in app/Module/Base.php, which executes eval"$array = $data;" whenever the decoded string starts...
CVE-2026-88394
WookTeam v1.6.6 and before is vulnerable to a Directory Traversal. The project task export endpoint /api/project/task/export downloads an arbitrary file from the server when the data parameter is supplied with a crafted JSON payload. The file value inside the JSON is concatenated directly into...
PT-2026-106065
A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon to panic...
PT-2026-104814
LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document's choosing. In fixed versions...
PT-2026-104817
URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not cover every place a document can supply a URL...
ROS-20261005-73-0098
The vulnerability in dotnet10.0 is related to incorrect processing of highly compressed input data. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...
ROS-20261005-73-0028
The vulnerability in rsync is related to errors in processing input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
ROS-20261005-73-0043
The vulnerability in expat is related to synchronization errors. Exploiting this vulnerability can allow an attacker to gain read, modify, or delete access to data, or cause a service failure...
ROS-20261005-73-0097
The vulnerability in dotnet8.0 is related to the incorrect processing of highly compressed input data. Exploiting this vulnerability can allow a remote attacker to cause service failures...
ROS-20261005-73-0092
The vulnerability in dotnet10.0 is related to the lack of protection for service data. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...
PT-2026-105998
WookTeam v1.6.6 and before is vulnerable to a Directory Traversal. The project task export endpoint /api/project/task/export downloads an arbitrary file from the server when the data parameter is supplied with a crafted JSON payload. The file value inside the JSON is concatenated directly into...
PT-2026-106273
Name of the Vulnerable Software and Affected Versions Dify versions prior to 1.16.0 Description An authenticated workspace member can modify the status and parameters of another application's MCP server, which could lead to service disruption or data redirection. This occurs because the...