438459 matches found
The vulnerability of the AppAuthentication::verifyCode() method in the packages/panels/src/Auth/MultiFactor/App/AppAuthentication.php file of the component set for the accelerated development of the Filament PHP framework Laravel allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the AppAuthentication::verifyCode method in the packages/panels/src/Auth/MultiFactor/App/AppAuthentication.php file of the Filament PHP framework’s Laravel set is related to the possibility of bypassing the authentication process. Exploiting this vulnerability could allow an...
The vulnerability of the reg() function in the lib/grammar.js module, a module for defining methods to access and manage XML documents, allows attackers to bypass existing security mechanisms.
The vulnerability of the reg function in the lib/grammar.js module, which is used for accessing and managing XML documents, is related to errors in processing XML requests. Exploiting this vulnerability could allow a malicious actor to bypass existing security mechanisms remotely...
The vulnerability of the Document.createElement() function in the XML document access and manipulation module XMLDOM allows attackers to bypass existing security mechanisms and perform cross-site scripting (XSS) attacks.
The vulnerability of the Document.createElement function in the XML document access and management module, XMLDOM, is related to errors in processing XML requests. Exploiting this vulnerability allows an attacker to bypass existing security mechanisms and perform cross-site scripting attacks XSS...
The vulnerability of Fortinet FortiWeb web applications’ network firewalls, related to authentication procedures that allow attackers to bypass existing security restrictions.
The vulnerability of Fortinet FortiWeb network firewalls is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow attackers to bypass existing security restrictions remotely...
The vulnerability of the aa_sock_msg_perm() function in the security/apparmor/lsm.c module of the AppArmor security component for the Linux operating system allows a attacker to compromise the confidentiality and integrity of the protected information.
The vulnerability of the aasockmsgperm function in the security/apparmor/lsm.c module of the AppArmor security component of the Linux operating system is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to compromise the confidentiality and integrit...
RHEL 8 / 9 : Satellite 6.16.13 Async Update (Important) (RHSA-2026:63327)
The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:63327 advisory. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessi...
Linux Distros Unpatched Vulnerability : CVE-2026-85152
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libevent (UTSA-2026-106162)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106162 advisory. Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttpdecodeuriinternal decodes...
RockyLinux 10 : buildah (RLSA-2026:63332)
The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:63332 advisory. crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application CVE-2026-33810 net/mail: golang: net/mai...
PT-2026-85544
Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to RangeFunction nodes in FROM clauses. Attackers can execute file-reading functions like pg read file through FROM-clause syntax to read arbitrary files despite restricted-mode...
CVE-2026-38961
Cross-Site Scripting XSS vulnerability in the RSS Widget of Netgate pfSense Plus versions 26.03, 25.11.1 and pfSense CE version 2.8.1 allows remote authenticated attackers to inject arbitrary JavaScript via malicious content in an RSS feed title. The injected script executes in the browser of any...
CVE-2026-75170
Cross-site scripting XSS vulnerability in the /loginController/doLogin endpoint of the HubCore platform version 14.1.1 allows a remote unauthenticated attacker to inject arbitrary JavaScript into the application's response via the language POST parameter...
PT-2026-85699
Cross-site scripting XSS vulnerability in the /loginController/doLogin endpoint of the HubCore platform version 14.1.1 allows a remote unauthenticated attacker to inject arbitrary JavaScript into the application's response via the language POST parameter...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libevent (UTSA-2026-106160)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106160 advisory. Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttpreadtrailer and merges...
UBUNTU-CVE-2026-80731
In the Linux kernel, the following vulnerability has been resolved: net: remove CAPSYSRAWIO zero-padding in devvalidateheader devvalidateheader reads dev-hardheaderlen directly when zero-padding short link layer headers for CAPSYSRAWIO holders: if capableCAPSYSRAWIO memsetllheader + len, 0,...
Flextype CMS 1.0.0-alpha.3 Authentication Bypass
Flextype CMS version 1.0.0-alpha.3 contains an authentication validation vulnerability in the API request-processing functionality. API endpoints may declare accesstoken as a required parameter, but the required-parameter validation only verifies that the corresponding key exists in the supplied...
Payara 7.2026.1.RC1 Arbitrary EJB Method Invocation
Payara Server exposes multiple HTTP-accessible EJB invocation mechanisms that rely on attacker-controlled reflection, dynamic class loading, and unsafe deserialization. These endpoints allow remote clients to perform arbitrary JNDI lookups, resolve attacker-supplied class names, and invoke EJB...
python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory
A flaw was found in the tarfile.extractall function within Python. A remote attacker could exploit this vulnerability by providing a specially crafted archive. This archive could bypass security filters by using a hardlink that references a symlink, allowing the symlink to be recreated outside th...
Important: Red Hat Security Advisory: python3.12 security update
An update for python3.12 is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...
