68762 matches found
CLEANSTART-2026-AW80260 Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL
Security vulnerability affects the buildkitd package. The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL...
GHSA-GFHX-HW2G-V5HG Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies
Impact serialize-javascript escapes its output so it is safe to embed inside a element. In 7.1.1 that guarantee does not hold for function values: a crafted function body can carry a literal, unescaped into the output, terminating the script element early so the remainder is parsed as HTML...
Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies
Impact serialize-javascript escapes its output so it is safe to embed inside a element. In 7.1.1 that guarantee does not hold for function values: a crafted function body can carry a literal, unescaped into the output, terminating the script element early so the remainder is parsed as HTML...
EUVD-2026-89027
Serialize JavaScript: Cross-site scripting XSS via unescaped in serialized function bodies...
CVE-2026-97957
A flaw was found in the Linux kernel's hinic network driver. An attacker with access to send mailbox messages, such as from a guest operating system utilizing a Virtual Function VF, a virtualized network interface, can exploit insufficient validation of message segment lengths. This flaw can caus...
EUVD-2026-89471
The "pattern" parameter used in search function in the home page of the TMS application is vulnerable to time-based blind SQL injection vulnerability...
CVE-2026-102089: Improper Limitation of a Pathname to a Restricted Directory
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness in an administrative import function allowed an authenticated administrator to write files to arbitrary locations on the server. This could potentially be leveraged to execute arbitrary code on the...
PT-2026-102970
A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This vulnerability affects the function detail of the file application/modules/admin/controllers/laporan data pasien.php. Executing a manipulation of the argument id param can lead to...
CentOS Linux 6 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal (CENTOS6:CLSA-2026:1777446368)
The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1777446368 advisory. - Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim's glob function on...
Linux Distros Unpatched Vulnerability : CVE-2026-97711
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.1.2, function values...
AlmaLinux 9.6 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal (ALMALINUX9.6:CLSA-2026:1777661044)
The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777661044 advisory. - Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim's glob function...
CentOS Linux 6 [TuxCare] Security Update: libssh2 / libssh2-devel / libssh2-docs (CENTOS6:CLSA-2026:1787063936)
The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1787063936 advisory. - libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftpopen function in src/sftp.c that allows a...
Malicious code in common-fs (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3d99fa69df24bb5170c840f84e44038c20cf8b431c94abfd57eaa3701593684 common-fs advertises itself as a filesystem/transaction helper but ships an obfuscated code loader. index.js reconstructs the identifiers 'Function',...
MAL-2026-17300 Malicious code in common-fs (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3d99fa69df24bb5170c840f84e44038c20cf8b431c94abfd57eaa3701593684 common-fs advertises itself as a filesystem/transaction helper but ships an obfuscated code loader. index.js reconstructs the identifiers 'Function',...
CVE-2026-91191
The device's update mechanism includes conditions that allow unauthorized software packages to be accepted as authentic. During the boot process, the stock done function disables signature verification in the OPKG configuration before restoring optional packages from a writable, unsigned feed...
CVE-2026-68954
The "pattern" parameter used in search function in the home page of the TMS application is vulnerable to time-based blind SQL injection vulnerability...
CVE-2026-68954 Toptech TMS7 and TopHAT SQL Injection
The "pattern" parameter used in search function in the home page of the TMS application is vulnerable to time-based blind SQL injection vulnerability...
CVE-2026-68954 Toptech TMS7 and TopHAT SQL Injection
The "pattern" parameter used in search function in the home page of the TMS application is vulnerable to time-based blind SQL injection vulnerability...
CVE-2026-100297
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, an unauthenticated network check function can be triggered to probe arbitrary hosts from the device’s internal network. This may expose internal information or leak data via DNS queries...
CVE-2026-100297 Server-Side request forgery (SSRF) in Anjvision YSSD-RTMP-H5
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, an unauthenticated network check function can be triggered to probe arbitrary hosts from the device’s internal network. This may expose internal information or leak data via DNS queries...