95475 matches found
cve-lab-journal
CVE Lab Journal !CVEs loggedhttps://img.shields.io/badge/C...
CVE-2026-61690 Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits
Grav is a file-based Web platform. Prior to 2.0.1, Grav ZipArchiver::extract in system/src/Grav/Common/Filesystem/ZipArchiver.php passes archives to ZipArchive::extractTo without enforcing the system.gpm.archive uncompressed-size, file-count, or nesting-depth limits. Code using...
CVE-2026-58565
Dell Command Update DCU, versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges...
CVE-2026-58562
Dell Command Update DCU, versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access...
DEBIAN-CVE-2026-47187
SSHFS is a network filesystem client for connecting to SSH servers. Prior to version 3.7.6, a rogue SFTP server can return absolute symlink targets or relative targets containing parent-directory components that SSHFS passes through FUSE for resolution by the client kernel against the local...
MINI-Q665-V638-F3W6
Bulletin has no description...
CVE-2026-58565
Dell Command Update (DCU) versions prior to 5.7.1 contain a Missing Authorization vulnerability. A low-privileged attacker with local access can exploit this flaw to achieve Elevation of Privileges , resulting in full compromise of confidentiality, integrity, and availability (CVSS 3.1: 8.8 HIGH ...
EUVD-2026-62521
Dell Command Update DCU, versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges...
CVE-2026-58565
Dell Command Update DCU, versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges...
CVE-2026-58565
Dell Command Update DCU, versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges...
MINI-5QW9-HWQX-WV6M
Bulletin has no description...
CVE-2026-58562
Dell Command Update (DCU) versions prior to 5.7.1 contain a Missing Authorization vulnerability. A low-privileged attacker with local access and user interaction could exploit this to gain unauthorized access to the system. The CVSS 3.1 score is 7.3 (HIGH) with vector AV:L/AC:L/PR:L/UI:R/S:U/C:H/...
EUVD-2026-62512
Dell Command Update DCU, versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access...
CVE-2026-58562
Dell Command Update DCU, versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access...
CVE-2026-75949 Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion (path traversal) in J-BusinessDirectory < 6.2.3
Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion path traversal in J-BusinessDirectory 6.2.3 - Upload/remove accepted a client-controlled root pathtype could point at the component site/admin trees, did not enforce path containment, and used a weak extension check. CSRF token w...
CVE-2026-45274 MyBooks: Unauthenticated Registration Bypass via Missing Server-Side ALLOW_REGISTER Enforcement
MyBooks is anebook management web server also known as Talebook. In 3.41.2 and earlier, the SignUp.post handler for POST /api/user/signup in webserver/handlers/user.py does not enforce the ALLOWREGISTER configuration flag, even though the frontend hides registration controls when the flag is fals...
CVE-2026-45273 MyBooks: Privilege Escalation via Missing Authorization on Admin Settings Endpoint
MyBooks is an ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler for POST /api/admin/settings in webserver/handlers/admin.py applies the auth decorator but does not check the self.adminuser property, unlike the corresponding GET handler. Any...
CVE-2026-45273 MyBooks: Privilege Escalation via Missing Authorization on Admin Settings Endpoint
MyBooks is an ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler for POST /api/admin/settings in webserver/handlers/admin.py applies the auth decorator but does not check the self.adminuser property, unlike the corresponding GET handler. Any...
CVE-2026-45273 MyBooks: Privilege Escalation via Missing Authorization on Admin Settings Endpoint
MyBooks is an ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler for POST /api/admin/settings in webserver/handlers/admin.py applies the auth decorator but does not check the self.adminuser property, unlike the corresponding GET handler. Any...