16503 matches found
CVE-2024-58362
SurrealDB vulnerability CVE-2024-58362 affects prior releases (before 1.5.5 and 2.0.0-beta before 2.0.0-beta.3) where an arbitrary object can be accepted in signin/signup via the RPC API without recursive validation for non-computed values. An unauthenticated attacker could encode a binary object...
SUSE-SU-2026:3108-1 Security update for joe
This update for joe fixes the following issue - CVE-2026-13412: arbitrary command execution via malicious tags file bsc1269379...
CVE-2026-15457
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.0.13 via the 'family' parameter. This makes it possible for authenticated attackers, with editor-level access and above, to delete...
EUVD-2026-45131
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.0.13 via the 'family' parameter. This makes it possible for authenticated attackers, with editor-level access and above, to delete...
CVE-2026-15457
Vulnerability summary (CVE-2026-15457) : The Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin is vulnerable to a Directory Traversal in all versions up to and including 6.0.13 via the 'family' parameter . Authenticated attackers with editor-level access or higher can d...
EUVD-2026-45083
Grav before 2.0.4 contains a regular expression denial of service ReDoS vulnerability in the regexreplace filter and function, which are allowlisted in the Twig content sandbox. When Twig processing in page content is enabled security.twigcontent.processenabled: true, disabled by default, an...
CVE-2026-62237 Grav < 2.0.4 ReDoS via regex_replace in Sandbox
Grav before 2.0.4 contains a regular expression denial of service ReDoS vulnerability in the regexreplace filter and function, which are allowlisted in the Twig content sandbox. When Twig processing in page content is enabled security.twigcontent.processenabled: true, disabled by default, an...
PT-2026-60976
Name of the Vulnerable Software and Affected Versions joe versions prior to 4.6-4.1 Description An issue allows arbitrary command execution through the use of a malicious tags file. Recommendations Update to version 4.6-4.1...
The vulnerability of the console-based graphic editor ImageMagick arises from a lack of mechanisms for encoding or shielding output data, allowing attackers to execute arbitrary code.
The vulnerability of the console-based graphic editor ImageMagick is related to the lack of mechanisms for encoding or shielding the output data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
The vulnerability of the console-based graphic editor ImageMagick, related to uncontrolled resource consumption, allows a hacker to cause a service failure.
The vulnerability of the console-based graphic editor ImageMagick is related to an uncontrolled consumption of resources. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...
The vulnerability of the decoder in the console-based ImageMagick graphics editor allows a hacker to trigger a service failure.
The vulnerability of the MAT decoder in the console-based ImageMagick graphics editor is related to reading data outside of the allowed range in memory. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...
PT-2026-60647
Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.4 Description A regular expression denial of service ReDoS exists in the regex replace filter and function, which are allowlisted in the Twig content sandbox. When Twig processing in page content is enabled via the...
The vulnerability of the magick-distribute-cache service in the console-based imageMagick graphics editor allows a hacker to trigger a service failure.
The vulnerability of the magick-distribute-cache service in the console-based imageMagick graphics editor is related to reading data beyond the allowed range of memory. Exploiting this vulnerability could allow an attacker to cause a service failure...
SUSE CVE-2026-8595
A user with Editor permissions can craft a dashboard whose table TableNG panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard stored cross-site scripting...
CVE-2026-59865
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, kiota info read x-ms-kiota-info.languagesInformation..dependencyInstallCommand plus dependency name and version values from an OpenAPI description and presented the spec-supplied command as Kiota's recommended insta...
CVE-2026-8595
A flaw in Grafana allows authenticated 'Editor' users to inject malicious scripts into a table panel's field names. Viewing the compromised dashboard executes the script in the victim's browser, risking data theft or client-side attacks...
The vulnerability of the Vim text editor, related to improper handling of code generation, allows a hacker to execute arbitrary code.
The vulnerability of the Vim text editor is related to improper handling of code generation. Exploiting this vulnerability can allow an attacker to execute arbitrary code...
EUVD-2025-210478
LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to Local File Inclusion LFI in the OnlyOfficeEditor servlet class, allowing authenticated user to exploit path traversal flaws in the fileExt parameter, enabling unauthorized access to sensitive files outside the designated directories...
The vulnerability of the Vim text editor lies in the lack of measures to neutralize special elements used in operating system commands, allowing attackers to execute arbitrary commands.
The vulnerability of the Vim text editor is related to the lack of measures taken to neutralize special elements used in operating system commands. Exploiting this vulnerability allows an attacker to execute arbitrary commands...