211845 matches found
CVE-2026-71494: Insufficiently Protected Credentials
Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remotevariablesloader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination...
PT-2026-79416
Name of the Vulnerable Software and Affected Versions FreeRTOS-Kernel versions prior to 11.3.1 Description Improper input validation may allow an unprivileged task on MPU-enabled ports to execute code in privileged kernel context. MPU Memory Protection Unit is a hardware component that monitors...
PT-2026-79409
Name of the Vulnerable Software and Affected Versions UAC Unix-like Artifacts Collector versions prior to 3.3.0 Description A command injection issue exists in the command collector function. The software substitutes command output lines directly into command strings using sed without proper...
PT-2026-79366
Name of the Vulnerable Software and Affected Versions Eventin WordPress plugin versions prior to 4.1.21 Description Insufficient validation of user-supplied webhook URLs stored on events and a failure to verify event ownership allow users with contributor-level access and above to trigger blind...
PT-2026-79293
The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
CVE-2026-77392: Improper Neutralization of Special Elements used in an SQL Command
A weakness has been identified in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This impacts the function saveUser of the file /public/submit.php. This manipulation of the argument Researcher causes sql injection. The attack may be initiated remotely. The exploit has...
PT-2026-79355
Name of the Vulnerable Software and Affected Versions io.micrometer:micrometer-registry-statsd affected versions not specified io.micrometer:micrometer-core affected versions not specified Description Failure to sanitize newline characters , r in metrics data allows for injection and spoofing...
PT-2026-80269
Summary The value of graphql.maxTake can be bypassed by providing a negative input. This can be used to exceed the developer's intended graphql.maxTake value, allowing queries to return results in excess of the graphql.maxTake value set. Impact This affects any project relying on graphql.maxTake ...
CVE-2026-16520
Genians Genian NAC V4.0, V5.0, and Genian ZTNA V6.0 contain improper input validation enabling SQL injection and authentication bypass (CVSS 8.7 HIGH). Affected versions: NAC V4.0 before 4.0.175, V5.0 before 5.0.88, ZTNA V6.0 before 6.0.48. No in-the-wild exploitation reported. Patch to the liste...
CVE-2026-16520
Improper input validation and Exposure of sensitive information through data queries vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, and Genians Genian ZTNA V6.0 allows SQL Injection and Authentication Bypass. This issue affects Genian NAC V4.0: from 4.0.0 before 4.0.175Revisio...
CVE-2026-16520
Improper input validation and Exposure of sensitive information through data queries vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, and Genians Genian ZTNA V6.0 allows SQL Injection and Authentication Bypass. This issue affects Genian NAC V4.0: from 4.0.0 before 4.0.175Revisio...
MINI-97J9-9XG9-XCV9
Bulletin has no description...
MINI-267M-2PFX-H2RH
Bulletin has no description...
MINI-7PQM-R477-QRGF
Bulletin has no description...
MINI-FR96-652M-W9J2
Bulletin has no description...
MINI-4JGH-MF9H-V2QH
Bulletin has no description...
MINI-RJ58-F4PG-X7H7
Bulletin has no description...
MINI-6XX3-CJCP-8MX7
Bulletin has no description...
CVE-2026-77648
In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass importfilteringopts, allowing an admin to fetch internal URLs from the Glance service network aka SSRF, as long as https:// or http:// is used. This API has been available only to admins since Xena, and it...