28894 matches found
CVE-2026-32608
Glances CVE-2026-32608 describes a local command-injection in the action system. Before 4.5.2, Mustache-rendered values such as process names, mount points, or container names could contain shell metacharacters that are not safely handled by secure_popen(), causing unintended command splitting. A...
CVE-2026-31938
jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of the options argument of the output function allows attackers to inject arbitrary HTML such as scripts into the browser context the created PDF is opened in. The vulnerability can be exploited in the followi...
CVE-2026-31891
CVE-2026-31891 affects Cockpit CMS 2.13.4 and earlier with API access enabled. A SQL injection in the MongoLite Aggregation Optimizer allows an attacker with a valid read-only API key to inject arbitrary SQL via unsanitized field names in aggregation queries (toJsonExtractRaw()), bypassing the pu...
CVE-2026-28674
Product/Context: xiaoheiFS (self-hosted financial/operational system). Vulnerability: In versions ≤ 0.3.15, the AdminPaymentPluginUpload endpoint allows admins to upload any file to plugins/payment/ with only a hardcoded password (qweasd123456) and disregards file content. A background watcher (S...
PT-2026-26041
Name of the Vulnerable Software and Affected Versions WebberZone Contextual Related Posts versions prior to 4.2.2 Description An authorization issue exists in WebberZone Contextual Related Posts due to incorrectly configured access control security levels. This allows for unauthorized access...
Jenkins 安全漏洞
Jenkins is an open-source application developed by Jenkins Project. The open-source automation server Jenkins offers hundreds of plugins to support building, deploying, and automating any project. Jenkins versions 2.554 and earlier, as well as LTS 2.541.2 and earlier, have security vulnerabilitie...
PT-2026-26195
Name of the Vulnerable Software and Affected Versions ZITADEL versions prior to 3.4.9 ZITADEL versions 4.0.0 through 4.12.2 Description ZITADEL, an open source identity management platform, had a flaw where organization enforcement during authentication could be bypassed. The platform uses scopes...
DiceBear 安全漏洞
DiceBear is an open-source library for generating random avatars. Versions of DiceBear prior to 9.4.0 contained a security vulnerability. This vulnerability stemmed from the ensureSize function, which read the width and height properties from the input SVG to determine the output canvas size. Thi...
jsPDF 安全漏洞
jsPDF is a JavaScript-based PDF document generation library developed by Parallax. Versions of jsPDF prior to 4.2.1 contained security vulnerabilities. These vulnerabilities stemmed from the possibility that parameters controlling the createAnnotation method could allow for the injection of...
Fedora 44 : aqualung / mac (2026-62f9125c65)
The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-62f9125c65 advisory. Latest Monkey's Audio Codec release. Changelog: https://monkeysaudio.com/versionhistory.html . Fixes CVE-2025-61043. Tenable has extracted the preceding...
CVE-2026-32297
creationtimestamp| type| source ---|---|--- 2026-03-17 18:58:51+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhbnqkje7s2k 2026-03-17 18:59:21+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhbnrh2ehj2c 2026-03-17 18:59:54+00:00| seen|...
EUVD-2026-12590
This High severity RCE Remote Code Execution vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This RCE Remote Code Execution vulnerability, with a CVSS Score of 8.6, allows an authenticated attacker to execute...
mysql: Optimizer unspecified vulnerability (CPU Jan 2026)
Oracle CPU describes the issue as following: Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network...
CVE-2026-3207 TIBCO BPM Enterprise Remote Code Execution (RCE) Vulnerability
Configuration issue in Java Management Extensions JMX in TIBCO BPM Enterprise version 4.x allows unauthorised access...
CVE-2026-25772
Wazuh Database synchronization module (wdb_delta_event.c) contains a stack-based buffer overflow due to an integer underflow in the query buffer size calculation. Affected range: 4.4.0 up to, and including, 4.14.2 (fixed in 4.14.3). If a payload causes the 2048-byte query buffer to overflow, the ...
CVE-2026-25771 Wazuh Vulnerable to Denial of Service via Synchronous I/O Blocking in Asynchronous Authentication Middleware
Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.3.0 and prior to version 4.14.3, a Denial of Service DoS vulnerability exists in the Wazuh API authentication middleware middlewares.py. The application uses an asynchronous event...
Moderate: Red Hat Security Advisory: compat-openssl11 security update
An update for compat-openssl11 is now available for Red Hat Enterprise Linux 9.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
CVE-2026-3888
Summary: CVE-2026-3888 is a local privilege escalation in snapd on Linux, enabling a local attacker to gain root by re-creating snap’s private /tmp directory when systemd-tmpfiles cleans it. Affected software: snapd on Linux distributions listed by the initial description (Ubuntu 16.04 LTS, 18.04...
UBUNTU-CVE-2026-3888
Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS...
