384527 matches found
CVE-2026-63268: Exposure of Sensitive Information to an Unauthorized Actor
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name a folder of local text files as a database, so opening a document could read a local text file into the sheet. In fixed versions only the csv, html and xml...
CVE-2026-63270: Exposure of Sensitive Information to an Unauthorized Actor
URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not cover every place a document can supply a URL...
CVE-2026-93319: Unsynchronized Access to Shared Data in a Multithreaded Context
A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon to panic...
PT-2026-104815
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name a folder of local text files as a database, so opening a document could read a local text file into the sheet. In fixed versions only the csv, html and xml...
PT-2026-104801
The JavaScript preprocessing Duktape engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data potentially resulting in leaked data from other running preprocessors not available to said administrator...
PT-2026-104817
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Opening a document containing specially crafted links allows the construction of URLs that expand environment variable or INI file values. This can lead to the...
PT-2026-106065
A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon to panic...
CVE-2026-103348: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in Smackcoders Inc. WP Ultimate Exporter wp-ultimate-exporter allows Object Injection.This issue affects WP Ultimate Exporter: from n/a through 3.0...
PT-2026-106193
Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Object Injection.This issue affects Sunshine Photo Cart: from n/a through 3.7.1...
CVE-2026-21589: Files or Directories Accessible to External Parties
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific fil...
PT-2026-106074
Name of the Vulnerable Software and Affected Versions Product Feed PRO for WooCommerce versions prior to 13.5.8 Description Deserialization of untrusted data in the woo-product-feed-pro plugin allows Object Injection. Object Injection occurs when an application deserializes untrusted data,...
CVE-2026-88394
WookTeam versions v1.6.6 and before are vulnerable to a Directory Traversal flaw within the project task export endpoint (/api/project/task/export). The root cause is the lack of path normalization or directory boundary checks when processing the data parameter. Specifically, a crafted JSON paylo...
CVE-2026-63277: Inclusion of Functionality from Untrusted Control Sphere
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such a link to be loaded from a remote location, so opening the document could run Java code from that location. In fixed versions an entry in...
CVE-2026-39783: Missing Authorization
Missing Authorization vulnerability in WP SYNTEX Polylang polylang allows Retrieve Embedded Sensitive Data.This issue affects Polylang: from n/a through 3.8.7...
Atlassian Jira < 9.12.40 / 10.3.x < 10.3.26 / 11.3.x < 11.3.12 (JRASERVER-79546)
The version of Atlassian Jira Server running on the remote host is affected by a vulnerability as referenced in the JRASERVER-79546 advisory. - h3. Summary This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center,...
Linux Distros Unpatched Vulnerability : CVE-2026-81841
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pausing a shared public dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shar...
Containerd Code Execution
The vulnerability of the Containerd process for importing the CRI of the runtime environment is related to insufficient verification of data authenticity. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
CVE-2026-71297: Missing Authentication for Critical Function
A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificate, to bypass authentication. This bypass enables the attacker to subscribe to other consumers' event streams, leading to unauthorized information disclosure, or to publish forge...
CVE-2026-97257: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in PressTigers Simple Event Planner simple-event-planner allows Object Injection.This issue affects Simple Event Planner: from n/a through 1.5.7...
