40751 matches found
CVE-2026-32822
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any unauthenticated attacker can place arbitrary HTML into flash...
CVE-2026-32822
Technical details are not publicly available in the provided documents. No specific affected versions, vulnerable components, or fixes are disclosed here. Monitor for updates.
MINI-HMM7-RF2X-QQRP
Bulletin has no description...
atril: evince: xreader: PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen
A flaw was found in Atril, Evince and Xreader. A malicious link inside a specially crafted PDF document can cause arbitrary code execution when clicked due to improper quoting of attacker-controlled PDF link-destination fields during remote go-to /GoToR actions. This issue allows an attacker to...
TencentOS Server 3: evince (TSSA-2026:0620)
The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0620 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...
Vulnerability of the DOM component: Mozilla Firefox’s navigation feature allows attackers to compromise the privacy and integrity of protected information.
Vulnerability of the DOM component: Mozilla Firefox’s navigation mechanism is associated with deficiencies in access control. Exploiting this vulnerability can allow an attacker to compromise the confidentiality and integrity of protected information...
The vulnerability of the R7-Officer corporate server’s document editor, related to improper code generation, allows a perpetrator to gain unauthorized access to protected information or execute arbitrary code.
The vulnerability of the R7-Officer corporate server’s document editor is related to improper handling of code generation. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information or execute arbitrary code...
The vulnerability of the R7-Officer corporate server’s document editor lies in the lack of protective measures for the website structure, allowing attackers to execute arbitrary JavaScript code.
The vulnerability of the R7-Officer corporate server document editor is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow an attacker to execute arbitrary JavaScript code...
TencentOS Server 2: compat-poppler022 (TSSA-2026:0651)
The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0651 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...
MINI-P3JG-8FMH-8WRH
Bulletin has no description...
Updated perl-CSS-Minifier-XS package fixes a security vulnerability
The updated package fixes a security vulnerability: CSS::Minifier::XS versions before 0.14 for Perl have a memory leak when the entire document is minified away. CVE-2026-13593...
XML External Entity (XXE) Injection
Overview net.sf.mpxj:mpxj is a Library that provides facilities to allow project information to be manipulated in Java and .Net. Affected versions of this package are vulnerable to XML External Entity XXE Injection in the DocumentBuilder process when parsing XML content from the ZTIMEINTERVALS...
MINI-5PG7-8JMX-4MCR
Bulletin has no description...
MINI-JC7F-8QMV-7HVH
Bulletin has no description...
CVE-2026-45703 Pimcore: WordExport Authorization Bypass for Unauthorized Document Export
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 LTS and 12.3.7, the WordExport export flow in bundles/WordExportBundle/src/Controller/TranslationController.php only checks the wordexport feature permission and directly resolves attacker-controlled type/id input...
MINI-6HGQ-M6FH-4HFM
Bulletin has no description...
MINI-9G2Q-554G-GF39
Bulletin has no description...
SUSE CVE-2026-13713
YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack. In the bundled libsyck, when an anchor name is redefined or removed, syckhdlraddanchor and syckhdlrremoveanchor free the node stored under that name with...
SUSE CVE-2026-57077
YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newlinelen. In the bundled libsyck newlinelen and isnewline dereference the scan pointer, and the following byte for a "\r\n" pair, with no NUL-terminator or bounds check. During block-scalar...