22831 matches found
CVE-2026-86665
A vulnerability was identified in aircheng-org iWebShop-5 up to 5.15. This issue affects the function Update::index of the file controllers/update.php. The manipulation leads to missing authorization. Remote exploitation of the attack is possible. The exploit is publicly available and might be...
CVE-2026-86732 Craft CMS before 5.10.12 Remote Code Execution via element-index
Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a malicious class via criteriawithTransforms0class that...
EUVD-2026-72868
Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a malicious class via criteriawithTransforms0class that...
CVE-2026-86732
Craft CMS versions before 5.10.12 contain a Remote Code Execution vulnerability in the element-index endpoint. Authenticated content editors can instantiate arbitrary classes by injecting a malicious class via criteria[withTransforms][0][class], which reaches ImageTransforms::normalizeTransform()...
CVE-2026-86732 Craft CMS before 5.10.12 Remote Code Execution via element-index
Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a malicious class via criteriawithTransforms0class that...
EUVD-2026-72809
A vulnerability was identified in aircheng-org iWebShop-5 up to 5.15. This issue affects the function Update::index of the file controllers/update.php. The manipulation leads to missing authorization. Remote exploitation of the attack is possible. The exploit is publicly available and might be...
CVE-2026-77091
DataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved maintenance release. Update Content Extractor and Index Store...
EUVD-2026-72723
DataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved maintenance release. Update Content Extractor and Index Store...
CVE-2026-77091 DataCube Security Feature Bypass
DataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved maintenance release. Update Content Extractor and Index Store...
CVE-2026-77091
Commvault DataCube contained a path traversal flaw that could bypass security feature enforcement . The CVSS 4.0 score is 8.5 (HIGH) , with a local attack vector requiring low privileges and no user interaction, resulting in high impact to confidentiality, integrity, and availability of the vulne...
Moderate: Red Hat Security Advisory: xz security update
An update for xz is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...
xz: XZ Utils: Denial of Service via buffer overflow in index decoding
A flaw was found in XZ Utils. When the lzmaindexdecoder function processes an empty index, and a subsequent lzmaindexappend operation is performed, insufficient memory is allocated. This can lead to a buffer overflow, potentially causing a denial of service DoS for affected systems...
expat security update
2.5.0-2.2 - Fix CVE-2026-56132: out-of-bound scaffolding index store in doProlog - Resolves: RHEL-221012 2.5.0-2.1 - Fix CVE-2026-50219 - Resolves: RHEL-220979...
PT-2026-88600
Improper validation of array index in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...
PT-2026-87129
Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a malicious class via criteriawithTransforms0class that...
Oracle Linux 10 : ELSA-2026-64810-0: / expat (ELSA-2026-648100)
The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-648100 advisory. - Fix CVE-2026-56132: out-of-bound scaffolding index store in doProlog - Fix CVE-2026-50219: forbid XMLParserFree/Reset from handlers - expat:...
NewStart CGSL MAIN 7.02 : rsync Vulnerability (NS-SA-2026-0113)
The remote NewStart CGSL host, running version MAIN 7.02, has rsync packages installed that are affected by a vulnerability: - A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The malicious...
CVE-2025-69727
CVE-2025-69727 Proveedor del producto INDEX-EDUCATION Código base del producto afectado PRONOTE - 202X.X.X 2025.2.8 Descripción Existe una vulnerabilidad de control de acceso incorrecto en INDEX-EDUCATION PRONOTE anterior a la versión 2025.2.8. Los componentes afectados composeUrlImgPhotoIndividu...