6616 matches found
CVE-2026-63740: Incorrect Authorization
SurrealDB versions before 3.1.4 fail to properly enforce SELECT permissions on array elements field. for record users, leaking denied array elements instead of hiding them. Attackers with record scope access can read array elements that element-level permissions should deny by exploiting incorrec...
PT-2026-61556
Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.1.4 Description Incorrect index handling during permission filtering allows attackers with record scope access to read array elements that should be restricted. This occurs when the system fails to properly enforc...
PT-2026-61674
The Joomla extension Quix Page Builder Pro is vulnerable to a unauthenticated path traversal via form elements. Unauthenticated users frontend users are allowed traversal paths and read arbitrary files. Requires a published page with a Form element...
PT-2026-61519
The Unlimited Elements For Elementor WordPress plugin before 2.0.11 does not sanitize or escape Google review content fetched from the Serp API before rendering it in the Google Reviews widget output, allowing unauthenticated attackers who submit a malicious review on the targeted business's Goog...
CVE-2026-10081: Improper Neutralization of Input During Web Page Generation
The Unlimited Elements For Elementor WordPress plugin before 2.0.11 does not sanitize or escape Google review content fetched from the Serp API before rendering it in the Google Reviews widget output, allowing unauthenticated attackers who submit a malicious review on the targeted business's Goog...
CVE-2026-64174
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: advance loop vars in cfg80211mergeprofile cfg80211mergeprofile reassembles a Multi-BSSID non-transmitted BSS profile that has been split across multiple consecutive MBSSID elements. Its while-loop calls...
EUVD-2026-45859
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: advance loop vars in cfg80211mergeprofile cfg80211mergeprofile reassembles a Multi-BSSID non-transmitted BSS profile that has been split across multiple consecutive MBSSID elements. Its while-loop calls...
EUVD-2026-45858
In the Linux kernel, the following vulnerability has been resolved: tracing: Do not call map-ops-eltfree if eltalloc fails In paths where tracingmapeltalloc failed to allocate objects, the map-ops-eltalloc call was never successful. In this case, map-ops-eltfree should not be called...
Cross-site Scripting (XSS)
Overview loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the SVG sanitizer's handling of the href attribute, which restricts xlink:href on SVG...
CVE-2026-52199: Improper Neutralization of Special Elements used in a Command
An issue in Generic OEM UZ801v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the sbin/adbd component...
The vulnerability of the Vim text editor lies in the lack of measures to neutralize special elements used in operating system commands, allowing attackers to execute arbitrary commands.
The vulnerability of the Vim text editor is related to the lack of measures taken to neutralize special elements used in operating system commands. Exploiting this vulnerability allows an attacker to execute arbitrary commands...
The vulnerability of the Vim text editor lies in the lack of measures to neutralize special elements used in operating system commands, allowing a malicious actor to execute arbitrary commands remotely.
The vulnerability of the Vim text editor is related to the lack of measures taken to neutralize special elements used in operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
The vulnerability of the Adobe Animate software for creating multimedia and computer animations lies in its failure to address the issue of eliminating special elements used in the operating system’s command line. This allows attackers to execute arbitrary code.
The vulnerability of the Adobe Animate software for creating multimedia and computer animations is related to the lack of measures taken to neutralize special elements used in the operating system’s command line. Exploiting this vulnerability allows an attacker to execute arbitrary code...
ROS-20260716-73-0061
The vulnerability of the Navigation function in Google Chrome and Microsoft Edge is related to improperly implemented security checks for standard elements. Exploiting this vulnerability allows a malicious actor to carry out spam attacks using a specially created HTML page...
The vulnerability of the Adobe Animate software for creating multimedia and computer animations lies in its failure to address the issue of eliminating special elements used in the operating system’s command line. This allows attackers to execute arbitrary code.
The vulnerability of the Adobe Animate software for creating multimedia and computer animations is related to the lack of measures taken to neutralize special elements used in the operating system’s command line. Exploiting this vulnerability allows an attacker to execute arbitrary code...
The vulnerability of the Vim text editor lies in the lack of measures to neutralize special elements used in operating system commands, allowing attackers to execute arbitrary commands.
The vulnerability of the Vim text editor is related to the lack of measures taken to neutralize special elements used in operating system commands. Exploiting this vulnerability allows an attacker to execute arbitrary commands...
CVE-2026-49458
A flaw was found in DOMPurify, a tool designed to prevent cross-site scripting XSS attacks by sanitizing HTML, MathML, and SVG content. When processing certain types of web page elements, DOMPurify failed to properly identify and sanitize malicious code. This oversight could allow an attacker to...
EUVD-2026-44114
Improper neutralization of special elements used in an sql command 'sql injection' in SQL Server allows an authorized attacker to elevate privileges over a network...
AstrBot has Incomplete Filtering of Special Elements
A security flaw has been discovered in AstrBotDevs AstrBot up to 4.22.1. This affects the function createtemplate of the file astrbot/dashboard/routes/t2i.py of the component Dashboard API. The manipulation results in improper neutralization of special elements used in a template engine. The atta...
TensorFlow vulnerable to `CHECK` failure in `TensorListReserve` via missing validation
ImpactIn core/kernels/listkernels.cc's TensorListReserve, numelements is assumed to be a tensor of size 1. When a numelements of more than 1 element is provided, then tf.rawops.TensorListReserve fails the CHECKEQ in CheckIsAlignedAndSingleElement.pythonimport tensorflow as...