110437 matches found
EUVD-2026-52254
CTI-Transmute is affected by a server-side request forgery vulnerability in the evaluation report PDF-generation functionality. User-controlled CTI content, including conversion names, descriptions, and comments, is converted from Markdown to HTML and rendered as a PDF using WeasyPrint. Before th...
gstreamer1-plugins-good: GStreamer: Heap buffer overflow in WavPack decoder via integer overflow
A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the buffer size calculation 4 blocksamples channels in gstwavpackdechandleframe causes a very small heap allocation. The WavPack library then writes...
CVE-2026-4793
An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or write arbitrary files and conduct denial-of-service during installation...
CVE-2026-16250
The Personal QR Message WordPress plugin through 1.0 does not restrict the file types that can be uploaded through an unauthenticated handler, allowing unauthenticated users to upload arbitrary executable PHP files that are directly reachable, leading to remote code execution...
CVE-2025-15673
The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowing high-privileged users to read arbitrary files on the server...
EUVD-2026-52187
An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or write arbitrary files and conduct denial-of-service during installation...
CVE-2026-4793
An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or write arbitrary files and conduct denial-of-service during installation...
CVE-2026-4793
CVE-2026-4793 affects Synology Assistant prior to 7.0.7-50095. The issue is an incorrect default permissions vulnerability that lets local users read or write arbitrary files and can cause a denial-of-service during installation. Affected component: Synology Assistant (client-side utility) with l...
CVE-2026-16250 Personal QR Message <= 1.0 - Unauthenticated Arbitrary File Upload
The Personal QR Message WordPress plugin through 1.0 does not restrict the file types that can be uploaded through an unauthenticated handler, allowing unauthenticated users to upload arbitrary executable PHP files that are directly reachable, leading to remote code execution...
CVE-2025-15673
The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowing high-privileged users to read arbitrary files on the server...
EUVD-2026-52168
The Webinfos WordPress plugin through 1.2 does not validate the type or name of uploaded files, nor restrict the upload action with any authentication, capability, or nonce check, allowing unauthenticated attackers to upload arbitrary files including PHP to a web-accessible directory, leading to...
Memory Allocation with Excessive Size Value
Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the BcKeyStoreSpi.engineLoad method, which sizes buffers for the certificate chain array, encoded certificates, encoded key material, entry data, and PBE salts directly from readInt length...
CVE-Poc_All_in_One
CVE Poc All in One 🛡️ This is a tool for searching, filtering...
PT-2026-67099
Name of the Vulnerable Software and Affected Versions Personal QR Message WordPress plugin versions prior to 1.1 Description An unauthenticated handler fails to restrict uploaded file types, enabling unauthenticated users to upload arbitrary executable PHP files. Since these files are directly...
PT-2026-67199
An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or write arbitrary files and conduct denial-of-service during installation...
PT-2026-67021
Name of the Vulnerable Software and Affected Versions Webinfos WordPress plugin versions prior to 1.3 Description The plugin fails to validate the type or name of uploaded files and does not restrict the upload action with authentication, capability, or nonce checks. This allows unauthenticated...
PT-2026-76145
In LibRaw, there is an out-of-bounds read vulnerability within the "LibRaw::parseSonySRF" function librawsrcmetadatasony.cpp when processing srf files...
CVE-2026-4793: Incorrect Default Permissions
An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or write arbitrary files and conduct denial-of-service during installation...
TencentOS Server 4: freerdp (TSSA-2026:0775)
The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0775 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...