4481 matches found
Yonyou YonBIP - Path Traversal
Yonyou YonBIP v3 and before contains a path traversal caused by improper validation in the LoginWithV8 interface of the series data application service system, letting unauthorized attackers access sensitive information. id: CVE-2025-66744 info: name: Yonyou YonBIP - Path Traversal author:...
Astra Linux – Vulnerability in exempi
The XMP Toolkit version 2020.1 and earlier versions is affected by a memory corruption vulnerability, which may lead to the execution of arbitrary code within the context of the current user. User interaction is required to exploit this vulnerability...
Astra Linux – Vulnerability in grub2
A flaw was discovered in grub2 in versions prior to 2.06. The rmmod implementation allows the unloading of a module that serves as a dependency without checking whether any other dependent modules are still loaded, leading to a “use-after-free” scenario. This could allow arbitrary code to be...
Unbound 1.26.0 DNSKEY Digest Heap Overflow
Unbound version 1.26.0 and earlier contains a heap buffer overflow in DNSKEY digest processing. The supplied tracker documents affected versions, upstream 1.26.1 remediation, and distribution patch status...
CVE-2025-55787
In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerability exists...
CVE-2025-55787
In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerability exists...
CVE-2025-55787
In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerability exists...
CVE-2025-55787
A SQL injection vulnerability exists in MailData Email Archiving System v4.2 and earlier . This flaw allows an attacker to execute unauthorized SQL commands, potentially leading to high impact on confidentiality , integrity , and availability . While the vulnerability is confirmed in the provided...
EUVD-2025-210930
In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerability exists...
Astra Linux – Vulnerability in Chromium
Type confusion in V8 in Google Chrome prior to 113.0.5672.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in PostgresSQL 11
An information leak was discovered in PostgreSQL versions prior to 13.2, before 12.6, and before 11.11. A user with UPDATE permission but without SELECT permission for a specific column could create queries that, under certain circumstances, might reveal values from that column in error messages...
SUSE CVE-2026-88264
A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected versions are crun 1.29.1 and earlier. Default configurations...
CVE-2026-85458 Divide-by-zero in Xpdf 4.06 due to zero-height Type 3 glyph
Divide-by-zero in Xpdf 4.06 and earlier, when a glyph in a Type 3 font has a zero height...
CVE-2026-45272 MyBooks: Remote Code Execution via SOCIAL_AUTH Key Name Injection in Python Config File
MyBooks is an enhanced and easy-to-use personal ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler in webserver/handlers/admin.py accepts SOCIALAUTH key names without validating quotes or newline characters, and SettingsLoader.dumpfile in...
CVE-2026-45274 MyBooks: Unauthenticated Registration Bypass via Missing Server-Side ALLOW_REGISTER Enforcement
MyBooks is anebook management web server also known as Talebook. In 3.41.2 and earlier, the SignUp.post handler for POST /api/user/signup in webserver/handlers/user.py does not enforce the ALLOWREGISTER configuration flag, even though the frontend hides registration controls when the flag is fals...
CVE-2026-48798 SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP Filenames
SSH.NET is a Secure Shell SSH library for .NET. In 2025.1.0 and earlier, ScpClient.Downloadstring directoryName, DirectoryInfo directoryInfo trusts file and directory names returned by a remote SCP server and combines them with the requested local directory without containment validation, allowin...
WeKan Trello Live Import attachment download lacks SSRF validation, allowing readable-response SSRF (LiveBleed)
WeKan Trello Live Import Attachment Download Lacks SSRF Validation, Allowing Readable-Response SSRF LiveBleed Vulnerability Overview WeKan supports two ways to import Trello boards: offline import and Live Import online API key mode. Download URLs on the offline import path all go through unified...
JLSEC-2026-1310
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 versions v0.27.4 and earlier. The out-of-bounds read is triggered when Exiv2 is used to read the metadata of a crafted image file. An...
JLSEC-2026-1309
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 versions v0.27.4 and earlier. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An...
