52192 matches found
EUVD-2026-59604
Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches...
CVE-2026-74278
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix kernel heap address leak in bounceerrorevent The comment above bounceerrorevent documents that user clients should receive SNDRVSEQEVENTBOUNCE with the original event embedded as variable-length data, while kernel...
Atom CMS v2.0 - SQL Injection
AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php. id: CVE-2022-24223 info: name: Atom CMS v2.0 - SQL Injection author: theamanrawat severity: critical description: | AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php...
Chuanhu Chat - Directory Traversal
The gaizhenbiao/chuanhuchatgpt application is vulnerable to a path traversal attack due to its use of an outdated gradio component. The application is designed to restrict user access to resources within the webassets folder. However, the outdated version of gradio it employs is susceptible to pa...
QNAP Music Station < 5.4.0 - Authentication Bypass
An improper authentication vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow users to compromise the security of the system via a network. We have already fixed the vulnerability in the following version: Music Station 5.4.0 and later id:...
Vite Dev Server - Directory Traversal
Vite is a modern frontend build tool. In Vite prior to versions 6.4.3, 6.3.4, and 5.4.23, a directory traversal vulnerability affects the Vite development server. When the Vite dev server is launched with the --host or server.host option, an unauthenticated attacker can craft a request with a pat...
Sonatype Nexus Repository Manager 3 - Local File Inclusion
Path Traversal in Sonatype Nexus Repository 3 allows an unauthenticated attacker to read system files. Fixed in version 3.68.1. id: CVE-2024-4956 info: name: Sonatype Nexus Repository Manager 3 - Local File Inclusion author: ritikchaddha severity: high description: | Path Traversal in Sonatype...
OpenCMS - Cross-Site Scripting
OpenCMS below 10.5.1 is vulnerable to Cross-Site Scripting vulnerability. id: CVE-2023-42343 info: name: OpenCMS - Cross-Site Scripting author: DhiyaneshDK severity: medium description: | OpenCMS below 10.5.1 is vulnerable to Cross-Site Scripting vulnerability. impact: | Unauthenticated attackers...
XWiki DeleteApplication - Cross-Site Scripting
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 6.2-milestone-1 through 16.10.9 and 17.0.0-rc-1 through 17.4.1 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates are vulnerable to a reflected XSS attack...
LocalAI - Partial Local File Read
A vulnerability in the /models/apply endpoint of mudler/localai versions 2.15.0 allows for Server-Side Request Forgery SSRF and partial Local File Inclusion LFI. The endpoint supports both https-// and file-// schemes, where the latter can lead to LFI. However, the output is limited due to the...
Symfony HttpFoundation - Access Control Bypass via PATH_INFO
Symfony HttpFoundation component = 2.0.0 and prior to versions 5.4.50, 6.4.29, and 7.3.7 contains an access control bypass vulnerability. The Request class improperly interprets some PATHINFO values, producing URL paths without a leading /. This allows bypassing access control rules that are buil...
LearnPress <= 4.2.5.7 - SQL Injection
The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 4.2.5.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...
CVE-2026-73845
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the ckangetmqaquality and ckangetmqaqualitydetails tools in src/tools/quality.ts use isValidMqaServer to validate the serverurl parameter with a prefix-only regular expression for dati.gov.it, allowing suffix-host an...
ROOT-APP-PYPI-CVE-2026-59935 CVE-2026-59935 in pypdf - Patched by Root
Root has patched CVE-2026-59935 in the pypdf package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-41313 CVE-2026-41313 in pypdf - Patched by Root
Root has patched CVE-2026-41313 in the pypdf package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-54530 CVE-2026-54530 in pypdf - Patched by Root
Root has patched CVE-2026-54530 in the pypdf package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-41314 CVE-2026-41314 in pypdf - Patched by Root
Root has patched CVE-2026-41314 in the pypdf package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-48735 CVE-2026-48735 in pypdf - Patched by Root
Root has patched CVE-2026-48735 in the pypdf package for Root:PyPI. Multiple fixed versions available...