3848 matches found
PYSEC-2026-3718
SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and DELETE operations on tables without explicit permissions. Attackers with database access or unauthenticated users on publicly exposed instances can perform unrestricted operations o...
CVE-2026-47303
A flaw was found in ASP.NET Core. An authorized attacker can exploit this authentication bypass vulnerability over a network by manipulating assumed-immutable data. This can allow the attacker to elevate their privileges within the system...
The vulnerability of embedded Qualcomm microprogramming software, related to reading memory outside the buffer, allows attackers to read and manipulate data.
The vulnerability of microprogramming software in embedded Qualcomm chips relates to reading memory data outside the buffer. Exploiting this vulnerability allows a remote attacker to read and manipulate data...
The vulnerability of embedded software developed by Qualcomm, related to operations performed outside of memory buffers, allows attackers to read and manipulate data.
The vulnerability of the BTM Action Frame Handler component in Qualcomm’s embedded software lies in the fact that the operation data is written outside of the memory buffer. Exploiting this vulnerability allows a remote attacker to read and manipulate the data...
CVE-2026-49981
A flaw was found in Twig, a template language for PHP. An attacker with low privileges could exploit a caching issue in the template sandboxing mechanism. This allows a sandboxed template to bypass its intended security policy, potentially leading to unauthorized information disclosure and limite...
vulnerabilities handled in Microsoft Developer Tools
Microsoft has identified vulnerabilities in Developer Tools, including .NET and Visual Studio. A malicious individual could exploit these vulnerabilities to execute attacks that can cause damage in the categories mentioned in the attached table. For successful exploitation, the malicious actor...
CVE-2026-62644
A flaw was found in the password plugin of Roundcube Webmail. A remote attacker with low privileges could exploit a username spoofing vulnerability by manipulating session data. This could lead to an account takeover, allowing the attacker to gain unauthorized access to a user's webmail account...
Vulnerabilities present in Siemens products
Siemens has identified vulnerabilities in various products, including CADRA, IAM, Mendix, OpCenter, RUGGEDCOM, SIDIS, and SIMATIC. These vulnerabilities pose a threat to malicious actors, who could exploit them to cause the following types of damage: - Denial-of-Service DoS attacks - Cross-Site...
Open WebUI: Mass Assignment via FeedbackForm extra=allow Allows Feedback User ID Spoofing and Evaluation Data Manipulation
Mass Assignment in Feedback Creation Allows User ID Spoofing and Evaluation Data Manipulation SummaryThe POST /api/v1/evaluations/feedback endpoint in Open WebUI v0.9.2 is vulnerable to mass assignment via FeedbackForm, which uses modelconfig = ConfigDictextra='allow'. Due to an insecure dictiona...
PYSEC-2026-2756 Open WebUI: Mass Assignment via FeedbackForm extra=allow Allows Feedback User ID Spoofing and Evaluation Data Manipulation
Mass Assignment in Feedback Creation Allows User ID Spoofing and Evaluation Data Manipulation Summary The POST /api/v1/evaluations/feedback endpoint in Open WebUI v0.9.2 is vulnerable to mass assignment via FeedbackForm, which uses modelconfig = ConfigDictextra='allow'. Due to an insecure...
PT-2026-59397
Mass Assignment in Feedback Creation Allows User ID Spoofing and Evaluation Data Manipulation Summary The POST /api/v1/evaluations/feedback endpoint in Open WebUI v0.9.2 is vulnerable to mass assignment via FeedbackForm, which uses model config = ConfigDictextra='allow'. Due to an insecure...
CVE-2026-10041
The CVE-2026-10041 entry concerns the WCFM – Frontend Manager for WooCommerce WordPress plugin (versions
WordPress WCFM – Frontend Manager for WooCommerce plugin <= 6.7.27 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Vendor Data Manipulation vulnerability
Authenticated Subscriber+ Missing Authorization to Arbitrary Vendor Data Manipulation vulnerability discovered by mrholmes, papadope in WordPress Plugin WCFM – Frontend Manager for WooCommerce versions = 6.7.27...
netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation
A flaw was found in Netty's DnsResolveContext. This vulnerability allows a remote attacker to achieve information disclosure or data manipulation by crafting malicious DNS responses. The flaw occurs because the DnsResolveContext fails to validate the origin bailiwick of CNAME records in DNS...
CVE-2026-58307
Out-of-bounds read, Reachable assertion vulnerability in Samsung Open Source Escargot allows Overread Buffers, Input Data Manipulation. This issue affects Escargot: before 2dee22f5c7b8bf31cb7252d7731fae8c07f2842c...
CVE-2026-58307
Out-of-bounds read, Reachable assertion vulnerability in Samsung Open Source Escargot allows Overread Buffers, Input Data Manipulation. This issue affects Escargot: before 2dee22f5c7b8bf31cb7252d7731fae8c07f2842c...
EUVD-2026-42578
Out-of-bounds read, Reachable assertion vulnerability in Samsung Open Source Escargot allows Overread Buffers, Input Data Manipulation. This issue affects Escargot: before 2dee22f5c7b8bf31cb7252d7731fae8c07f2842c...
CVE-2026-58307
Technical details, affected components, and remediation are not publicly available in the provided documents. Monitor for updates from official advisories and connected sources.
CVE-2026-58307: Out-of-bounds Read
Out-of-bounds read, Reachable assertion vulnerability in Samsung Open Source Escargot allows Overread Buffers, Input Data Manipulation. This issue affects Escargot: before 2dee22f5c7b8bf31cb7252d7731fae8c07f2842c...
PT-2026-56782
Out-of-bounds read, Reachable assertion vulnerability in Samsung Open Source Escargot allows Overread Buffers, Input Data Manipulation. This issue affects Escargot: before 2dee22f5c7b8bf31cb7252d7731fae8c07f2842c...