332952 matches found
Flextype CMS 1.0.0-alpha.3 Authentication Bypass
Flextype CMS version 1.0.0-alpha.3 contains an authentication validation vulnerability in the API request-processing functionality. API endpoints may declare accesstoken as a required parameter, but the required-parameter validation only verifies that the corresponding key exists in the supplied...
EUVD-2026-71450
An arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to retrieve arbitrary files from the device filesystem via the file query string parameter...
CVE-2026-75164
An arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to retrieve arbitrary files from the device filesystem via the file query string parameter...
Linux Distros Unpatched Vulnerability : CVE-2026-76176
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SQL injection vulnerability in the endpoint /ocsreports/index.php?function=admindouble due to improper processing of the values in the ID field included in the...
O-CMS 1.0.0 Command Injection
O-CMS version 1.0.0 contains an authenticated OS command injection vulnerability in the AI CLI configuration functionality. An authenticated attacker with sufficient privileges can supply shell metacharacters and additional commands through the aicliscript parameter of /admin/settings/save...
VulnCheck KEV: CVE-2024-11080
The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to 2.3.1 via several functions in the /includes/blocks/form-wrap/function.php file. This makes it possible for unauthenticated attackers to execute actions with...
CVE-2026-79419
A reflected cross-site scripting XSS vulnerability exists in EMX Tecnologia Gestao X Business Suite 8.4 and earlier. The vulnerability is caused by insufficient validation and sanitization of the mensagem parameter in the /Configuracao/Imagens.aspx endpoint, allowing an authenticated attacker to...
RHEL 8 : container-tools:rhel8 (RHSA-2026:63163)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:63163 advisory. The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: net/mail:...
Linux Distros Unpatched Vulnerability : CVE-2026-80828
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: usb-audio: Complete cleanup after system-resume errors A failed system resume can leave the card unusable until reboot. usbaudioresume jumps to errout whe...
Dear Flipbook < 2.4.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.df-element' Element Inner HTML
Description The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcontent Custom HTML block inner HTML' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and...
PT-2026-85470
A Path Traversal vulnerability in the builder endpoint in Google Cloud Agent Development Kit ADK versions 1.9.0 through 1.21.0 on Python allows an unauthenticated remote attacker to read arbitrary files using a crafted file path query parameter...
MAL-2026-16044 Malicious code in tsshare (PyPI)
The PyPI package tsshare is malicious. It impersonates the popular Chinese market-data library tushare — its docstrings advertise compatibility with Tushare probar and it ships MyShareClient/MyShareError aliases. tsshare/client.py conceals its default API endpoint by base64-decoding it at runtime...
The vulnerability of the __sctp_rcv_asconf_lookup() function in the net/sctp/input.c module of the Linux operating system’s SCTP protocol implementation allows a attacker to gain access to protected information or cause service interruptions.
The vulnerability of the sctprcvasconflookup function in the net/sctp/input.c module of the Linux operating system’s SCTP protocol implementation is related to improper handling of length parameter discrepancies. Exploiting this vulnerability can allow an attacker to gain access to protected...
Malicious code in @avigilon/node-webrtc (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 856277989637849346e759b8d07577326b164b5521ee643a84d704a457ad9f87 package.json declares a preinstall hook that runs index.js on npm install. index.js requires os, dns, https, querystring, and the package's own...
MAL-2026-15865 Malicious code in @avigilon/node-webrtc (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 856277989637849346e759b8d07577326b164b5521ee643a84d704a457ad9f87 package.json declares a preinstall hook that runs index.js on npm install. index.js requires os, dns, https, querystring, and the package's own...
Malicious code in 0nestjs (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54eee258f343282c30f3efc6b5effc8aac283b7b02421433c14dee3e14f27aa3 Package name 0nestjs targets developers mistyping nestjs. On npm install, the postinstall hook node index.js executes automatically and performs two...
MAL-2026-15908 Malicious code in 0nestjs (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54eee258f343282c30f3efc6b5effc8aac283b7b02421433c14dee3e14f27aa3 Package name 0nestjs targets developers mistyping nestjs. On npm install, the postinstall hook node index.js executes automatically and performs two...
07-Web-Application-Security
Cybersecurity Home Lab - Lab 7: Web Application Security O...
CVE-2026-85439
MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::handlePreCheckSplitDir function that fails to sanitize shell metacharacters in log file pathnames. Attackers can embed shell syntax in log file names or the --dir parameter to execute arbitrary...
jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...