210685 matches found
NewStart CGSL MAIN 7.02 : gnupg2 Vulnerability (NS-SA-2026-0098)
The remote NewStart CGSL host, running version MAIN 7.02, has gnupg2 packages installed that are affected by a vulnerability: - In GnuPG before 2.4.9, armorfilter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. For...
PT-2026-87797
Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...
ROS-20260908-73-0034
The vulnerability in Golang-X-Net is related to incorrect checking of the unsafe equivalence of input data. Exploiting this vulnerability allows an attacker to bypass existing security restrictions and execute arbitrary code...
PT-2026-87070
A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated user with the required privileges can define a dashboard containing a malicious payload, or a victim can be socially engineered into importing a...
PT-2026-88436
Name of the Vulnerable Software and Affected Versions Okta Access Gateway affected versions not specified Description The software fails to sanitize dashboard label values before writing them into generated PHP configuration files. Because these files are automatically included during...
PT-2026-88308
Name of the Vulnerable Software and Affected Versions ColdFusion affected versions not specified Description An improper input validation issue allows a low-privileged attacker to execute arbitrary code in the context of the current user. Exploitation requires user interaction, specifically...
PT-2026-88214
In initAppLinkTypeAndIntent of ChannelImpl.java, there is a possible launch an arbitrary intent due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...
PT-2026-88280
Improper neutralization of input during web page generation 'cross-site scripting' in Skype for Business allows an unauthorized attacker to perform spoofing over a network...
ROS-20260908-73-0080
The vulnerability of the Media component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to replace the user interface through a created HTML page...
PT-2026-88317
Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization. The...
PT-2026-88427
Name of the Vulnerable Software and Affected Versions Okta Access Gateway affected versions not specified Description The management console passes user-supplied input to the eval function without proper sanitization during an authenticated administrator SSH session. This allows the unsanitized...
PT-2026-88254
In parsePartHeaders of multiple files, there is a possible persistent denial of service due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-16502: Deserialization of Untrusted Data
The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to injec...
CVE-2026-16025: Improper Validation of Specified Quantity in Input
Improper validation of specified quantity in input vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module allows Input Data Manipulation. This issue affects PayTR Virtual Pos iFrame API WHMCS Module: from v9.0.0 before v9.0.3...
PT-2026-87108
Name of the Vulnerable Software and Affected Versions PayTR Virtual Pos iFrame API WHMCS Module versions 9.0.0 through 9.0.2 Description Improper validation of the specified quantity in the input allows for input data manipulation within the PayTR Virtual Pos iFrame API WHMCS Module...
PT-2026-88335
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3 could allow an attacker to bypass authorization by manipulating URL query parameters due to incorrect mapping of values to untrusted query string input...
EulerOS 2.0 SP12 : jbig2dec (EulerOS-SA-2026-3269)
According to the versions of the jbig2dec packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : An integer overflow in the jbig2arithiaidctxnew function of Artifex commit cc37d0 allows attackers to cause a Denial of Service DoS via a crafte...
PT-2026-87033
The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level...
PT-2026-88304
Illustrator is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim mus...