398933 matches found
CVE-2026-89286 FormFlow for GoHighLevel <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via Log File
The FormFlow for GoHighLevel GHL WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside the publicly accessible uploads directory, allowing unauthenticated attackers to read its contents, which include connected-CRM identifiers and, on sites that have linked the...
openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls
A flaw was found in OpenSSL. When applications directly call the low-level CRYPTOocb128encrypt or CRYPTOocb128decrypt functions with non-block-aligned lengths in a single call on hardware-accelerated builds, the trailing 1-15 bytes of a message may be exposed in cleartext. These exposed bytes are...
Important: Red Hat Security Advisory: openssl security update
An update for openssl is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls
A flaw was found in OpenSSL. When applications directly call the low-level CRYPTOocb128encrypt or CRYPTOocb128decrypt functions with non-block-aligned lengths in a single call on hardware-accelerated builds, the trailing 1-15 bytes of a message may be exposed in cleartext. These exposed bytes are...
Important: Red Hat Security Advisory: openssl security update
An update for openssl is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
Multiple vulnerabilities in IBM Java SDK affect AIX
IBM SECURITY ADVISORY First Issued: Mon Oct 19 04:45:00 CDT 2026 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/javaoct2026advisory.asc Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect AIX...
cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste
A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link symlink and then using the privileged "Paste as owner" function. This allows for arbitrary file ownership changes outside the intended pasted directory,...
MAL-2026-17927 Malicious code in fabtoolkit (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e55333b9d934a04c029943e0e6fbf34fff7c1344e0d1964b6860bc02d322855d fabtoolkit executes a payload embedded as a CHILD string run via subprocess.runsys.executable,'-I','-c',CHILD,... that fetches a JSON config from...
store-api
RESTful API auto-generation for common-store data layer fastify + fastapi adapters over GQL, spec-driven dual-runtime parity...
Linux kernel LZNT Decompression Data Compromise
The vulnerability in the decompresslznt function within the fs/ntfs3/lznt.c component of the Linux kernel operating system is related to buffer overflow conditions. Exploitation of this vulnerability may allow an attacker to compromise the confidentiality, integrity, and availability of protected...
Navigation section of Microsoft Data Compromise
The vulnerability in the Navigation section of Microsoft Edge and Google Chrome browsers is related to insufficient input validation. Exploitation of this vulnerability enables a remote attacker to compromise the integrity of protected information by using a specially crafted HTML page...
GitLab Access Control Issue
The vulnerability of the Git-based software platform for collaborative code development in GitLab EE/CE is related to deficiencies in the access control mechanism. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to modify and delete any data they wish...
Navigation section of Microsoft Data Compromise
The vulnerability in the Navigation section of Microsoft Edge and Google Chrome browsers is related to insufficient input validation. Exploitation of this vulnerability enables a remote attacker to compromise the integrity of protected information by using a specially crafted HTML page...
Navigation section of Microsoft Data Compromise
The vulnerability in the Navigation section of Microsoft Edge and Google Chrome browsers is related to the user interface’s false representation of critical information. Exploitation of this vulnerability enables a remote attacker to compromise the integrity of protected data by using a specially...
Hugo Static Site Generator Bypass
The vulnerability of the Hugo static site generator is related to deficiencies in the mechanism for processing register-dependent data. Exploiting this vulnerability allows an attacker to bypass existing security measures...
CVE-2026-85296: Exposure of Data Element to Wrong Session
Exposure of Data Element to Wrong Session vulnerability in Apache Camel AS2 component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Signing material belonging to an individual request was stored in state that is shared across requests rather than confined ...
CVE-2026-107084
Slims Senayan Library Management Systems 9 Bulian 9.8.0 allows cross-site request forgery CSRF against admin/modules/circulation/loanhistorymaintenance.php because the action=run GET parameter performs privileged, destructive operations with no CSRF token or POST confirmation, leading to data los...
CVE-2026-12254: Insufficient Session Expiration
Netskope is notified about a potential gap in its agent NSClient where a system with Netskope Client while connecting to an access point with Captive Portal switches to a Network which already has internet connectivity, the Captive Portal does not close. This allows the possibility of abuse via t...
CVE-2026-12669: Out-of-bounds Read
IBM MQ could allow an authenticated attacker to trigger a minor out-of-bounds read when sending malformed compressed data, though the data is not disclosed and the request is rejected...
PT-2026-117513
IBM MQ could allow an authenticated attacker to trigger a minor out-of-bounds read when sending malformed compressed data, though the data is not disclosed and the request is rejected...