18316 matches found
vulnerabilities found in Apple MacOS
Apple has addressed several vulnerabilities in MacOS, specifically in the versions Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.x. These vulnerabilities involve various security issues in macOS, including insufficient sandbox restrictions, which may allow applications to gain unauthorized access t...
Kaseya VSA < 9.5.7 - Credential Disclosure via Windows Agent
Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.asp When an attacker download a client...
GO-2026-5426 Opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking in go.opentelemetry.io/otel/sdk
Opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking in go.opentelemetry.io/otel/sdk...
CVE-2026-16519
A DLL hijacking vulnerability exists in the GeoVision GV-IP Device Utility desktop application. The application loads one or more dynamic-link libraries DLLs from an unsafe search path, allowing a local attacker to place a malicious DLL in a location searched before the legitimate library locatio...
CVE-2026-16519
A DLL hijacking vulnerability exists in the GeoVision GV-IP Device Utility desktop application. The application loads one or more dynamic-link libraries DLLs from an unsafe search path, allowing a local attacker to place a malicious DLL in a location searched before the legitimate library locatio...
CVE-2026-16519
Vulnerability overview. CVE-2026-16519 affects the GeoVision GV-IP Device Utility desktop application, where it loads DLLs from an unsafe search path. This DLL search order hijacking allows a local attacker to place a malicious DLL in a location that’s searched before the legitimate library, enab...
CVE-2026-65697
Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...
CVE-2026-65697 Fathom Lite 1.3.1 Stored XSS via /collect Endpoint
Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...
EUVD-2026-48311
Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...
CVE-2026-65697 Fathom Lite 1.3.1 Stored XSS via /collect Endpoint
Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...
CVE-2026-65697
Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...
SSL VPN Session Hijacking
An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication. id: CVE-2024-53704 info: name: SSL VPN Session Hijacking author: johnk3r severity: critical description: | An Improper Authentication vulnerability in the SSLVPN...
VulnCheck KEV: CVE-2026-8496
A cross-site scripting XSS vulnerability exists in Alinto SOGo, version 5.12.7. A maliciously crafted ICS calendar invitation files allows arbitrary JavaScript execution within the authenticated SOGo webmail session. The issue occurs because SVG content embedded in the description field of an ICS...
Duplicate Advisory: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-p3rg-hrf9-w9gj. This link is maintained to preserve external references. Original Description n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in...
CVE-2026-64024
A flaw was found in the Linux kernel's Transmission Control Protocol TCP networking stack. This vulnerability arises from a stale per-CPU variable that can retain a previously used Initial Sequence Number ISN when certain packets are dropped. A remote attacker could exploit this by sending...
Plone @plone/volto 14.0.0-alpha.5 < 15.0.0-alpha.0 Insecure Authentication
The version of the @plone/volto Node.js Package installed on the remote host is later than 14.0.0-alpha.5 prior to 15.0.0-alpha.0. It is, therefore, affected by an insecure authenticaiton vulnerability. A user could have their authentication cookie replaced with an authentication cookie from...
CVE-2026-56583
HCL MyCloud was affected with Concurrent Login Vulnerability. It may increase the risk of unauthorized access, session hijacking, and account misuse...
EUVD-2026-46346
HCL MyCloud was affected with Concurrent Login Vulnerability. It may increase the risk of unauthorized access, session hijacking, and account misuse...
CVE-2026-56583 HCL MyCloud was affected with Concurrent Login Vulnerability.
HCL MyCloud was affected with Concurrent Login Vulnerability. It may increase the risk of unauthorized access, session hijacking, and account misuse...