15958 matches found
CVE-2026-32767
SiYuan is a personal knowledge management system. Versions 3.6.0 and below contain an authorization bypass vulnerability in the /api/search/fullTextSearchBlock endpoint. When the method parameter is set to 2, the endpoint passes user-supplied input directly as a raw SQL statement to the underlyin...
SiYuan 安全漏洞
SiYuan is a privacy-oriented personal knowledge management system developed by SiYuan OpenSource. Versions of SiYuan 3.6.0 and earlier contained security vulnerabilities. These vulnerabilities stemmed from an authorization bypass in the/api/search/fullTextSearchBlock endpoint, which could allow...
CVE-2026-23272
In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: unconditionally bump set-nelems before insertion In case that the set is full, a new element gets published then removed without waiting for the RCU grace period, while RCU reader can be walking over it...
PT-2026-26630
A command injection vulnerability on AX53 v1 occurs in mscd debug functionality due to insufficient input handling, allowing log redirection to arbitrary files and concatenation of unvalidated file content into shell commands, enabling authenticated attackers to inject and execute arbitrary...
NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion
Summary NiceGUI's app.addmediafile and app.addmediafiles media routes accept a user-controlled query parameter that influences how files are read during streaming. The parameter is passed to the range-response implementation without validation, allowing an attacker to bypass chunked streaming and...
EUVD-2025-208885
Use of a deterministic credential generation algorithm in /ftl/bin/calcf2 in Small Cell Sercomm SCE4255W FreedomFi Englewood firmware before DG3934v3@2308041842 allows remote attackers to derive valid administrative/root credentials from the device's MAC address, enabling authentication bypass an...
CVE-2025-67114
Use of a deterministic credential generation algorithm in /ftl/bin/calcf2 in Small Cell Sercomm SCE4255W FreedomFi Englewood firmware before DG3934v3@2308041842 allows remote attackers to derive valid administrative/root credentials from the device's MAC address, enabling authentication bypass an...
Malicious code in @iflow-mcp/watercrawl-watercrawl-mcp (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 824ca65d425a95c473a1bd8d193811e3ab4a816ba82e3e2950e5dde508ae2bd0 The package @iflow-mcp/watercrawl-watercrawl-mcp was found to contain malicious code. Source: ghsa-malware...
CVE-2026-32866
OPEXUS eComplaint and eCASE before 10.2.0.0 do not correctly sanitize the contents of first and last name fields in a user profile. An authenticated attacker can inject parts of an XSS payload in their first and last name fields. The payload is executed when the user's full name is rendered. The...
MAL-2026-1927 Malicious code in changelog-logger-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34f7f28c6593ecad4f4308faa51ad2d06d6feb541dbc1ab634179bced34a3d95 The package changelog-logger-utils was found to contain malicious code. Source: ghsa-malware...
MAL-2026-1925 Malicious code in jsonify-parser (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ef3f7d9cb714309502cac987c904c29a8eda1fda1fcd8f5fffabfa339a64369 The package jsonify-parser was found to contain malicious code. Source: ghsa-malware 4d17ffa1ebe907cee2cc4cf5fd22ab76acd112213237bcac49b62b06a002c1cb...
Malicious code in jsonify-parser (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ef3f7d9cb714309502cac987c904c29a8eda1fda1fcd8f5fffabfa339a64369 The package jsonify-parser was found to contain malicious code. Source: ghsa-malware 4d17ffa1ebe907cee2cc4cf5fd22ab76acd112213237bcac49b62b06a002c1cb...
Exploit for CVE-2024-11114
Chromium Exploit Development Toolkit A toolkit for weaponizing...
PT-2026-26310
OPEXUS eComplaint and eCASE before 10.2.0.0 do not correctly sanitize the contents of first and last name fields in the 'My Information' screen. An authenticated attacker can inject parts of an XSS payload in the first and last name fields. The payload is executed when the full name is rendered...
PT-2026-26308
OPEXUS eComplaint and eCASE before 10.2.0.0 do not correctly sanitize the contents of first and last name fields in a user profile. An authenticated attacker can inject parts of an XSS payload in their first and last name fields. The payload is executed when the user's full name is rendered. The...
PT-2026-26319
Use of a deterministic credential generation algorithm in /ftl/bin/calc f2 in Small Cell Sercomm SCE4255W FreedomFi Englewood firmware before DG3934v3@2308041842 allows remote attackers to derive valid administrative/root credentials from the device's MAC address, enabling authentication bypass a...
CVE-2025-67114
Use of a deterministic credential generation algorithm in /ftl/bin/calcf2 in Small Cell Sercomm SCE4255W FreedomFi Englewood firmware before DG3934v3@2308041842 allows remote attackers to derive valid administrative/root credentials from the device's MAC address, enabling authentication bypass an...
ROS-20260319-73-0024
A vulnerability in the Core component of the Oracle VM VirtualBox virtual machine is related to access differentiation flaws. Exploitation of the vulnerability could allow an attacker to gain full control over the system...
ROS-20260319-73-0025
A vulnerability in the Core component of the Oracle VM VirtualBox virtual machine is related to access differentiation flaws. Exploitation of the vulnerability could allow an attacker to gain full control over the system...
CVE-2026-32736
The Hytale Modding Wiki is a free service for Hytale mods to host their documentation & wikis. An Insecure Direct Object Reference IDOR vulnerability in versions of the wiki prior to 1.0.0 exposes mod authors' personal information - including full names and email addresses - to any authenticated...