CVE-2026-88276: Improper Neutralization of Special Elements used in an OS Command

GeoVision GV-LPC2211 V1.13 allows administrator-controlled WEP key values containing shell syntax to execute arbitrary commands as root...

CVE-2026-48088

OpenReception’s OpenReception appointment-booking software (prior to version 1.0.4) is vulnerable to unauthenticated crypto key provisioning via POST /api/tenants/{tenantId}/staff/{staffId}/crypto, allowing attacker-controlled ML-KEM-768 public keys to be registered for any tenant. The handler lo...

OPENSUSE-SU-2026:21410-1 Security update for glib2

This update for glib2 fixes the following issues: - CVE-2026-58010: error during gvstupleisnormal alignment validation could cause a 1-byte out-of-bounds read bsc1270009. - CVE-2026-58011: invalid GDateTime in gdatetimegetymd could trigger a 2-byte out-of-bounds read bsc1270010. - CVE-2026-58012:...

GHSA-HH43-Q692-2XMQ Duplicate Advisory: `OpenClaw: session_status` let sandboxed subagents access parent or sibling session state

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-wcxr-59v9-rxr8. This link is maintained to preserve external references. Original Description OpenClaw before 2026.3.11 contains a session sandbox escape vulnerability in the sessionstatus tool that allows...

CVE-2026-24140 MyTube has Mass Assignment via Settings Management

MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below have a Mass Assignment vulnerability in the settings management functionality due to insufficient input validation. The application's saveSettings function accepts arbitrary key-value pairs without...

EUVD-2020-19096

Malware in sbrugna...

UBUNTU-CVE-2025-22865

Using ParsePKCS1PrivateKey to parse a RSA key that is missing the CRT values would panic when verifying that the key is well formed...

CVE-2024-39342

Entrust Instant Financial Issuance formerly known as Cardwizard 6.10.0, 6.9.0, 6.9.1, 6.9.2, and 6.8.x and earlier uses a DLL library i.e. DCG.Security.dll with a custom AES encryption process that relies on static hard-coded key values. These keys are not uniquely generated per installation of t...

Deserialization Of Untrusted Data

Apache IoTDB is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to directly deserializing the key/values from the deviceOwnerFile within the deSerializeDeviceOwnerMap method. Each key/value from the owner file is parsed directly using the ObjectOutputStream class, withou...

HUSKY – Products Filter for WooCommerce (formerly WOOF) < 1.3.4.3 - Missing Authorization via woof_meta_get_keys()

Description The HUSKY – Products Filter for WooCommerce formerly WOOF plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the woofmetagetkeys function in versions up to, and including, 1.3.4.2. This makes it possible for authenticated attackers,...

Authentication flaw

The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2. This is due to insufficient encryption on the user being supplied during the abandoned cart link decode through the plugin. This allows unauthenticated...

CVE-2023-2986 Abandoned Cart Lite for WooCommerce <= 5.15.1 - Authentication Bypass

The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2. This is due to insufficient encryption on the user being supplied during the abandoned cart link decode through the plugin. This allows unauthenticated...

SUSE CVE-2007-6755

The NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation DualECDRBG algorithm contains point Q constants with a possible relationship to certain "skeleton key" values, which might allow context-dependent attackers to defeat cryptographic protection...

CVE-2020-26551

An issue was discovered in Aviatrix Controller before R5.3.1151. Encrypted key values are stored in a readable file...

Remote file inclusion

An issue was discovered in Aviatrix Controller before R5.3.1151. Encrypted key values are stored in a readable file...

CVE-2020-26551

An issue was discovered in Aviatrix Controller before R5.3.1151. Encrypted key values are stored in a readable file...

PT-2020-16454

Name of the Vulnerable Software and Affected Versions Aviatrix Controller versions prior to R5.3.1151 Description An issue was discovered where encrypted key values are stored in a readable file. Recommendations For Aviatrix Controller versions prior to R5.3.1151, update to version R5.3.1151 or...

CVE-2020-26551: Cleartext Storage of Sensitive Information

An issue was discovered in Aviatrix Controller before R5.3.1151. Encrypted key values are stored in a readable file...

OSV-2020-373 UNKNOWN READ in url_decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14501 Crash type: UNKNOWN READ Crash state: urldecode parsekeyvalues fuzzparsehttprequest...

PT-2020-22279

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type of UNKNOWN READ. The crash state involves several functions: url decode, parse key values, and fuzz parse http request...