134146 matches found
CVE-2026-54205 TeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in link storing functionality
Tobit Laboratories AG TeamDavid's Webbox 's link storing functionality //ServerClientcelink.htm accepts a “pathname” parameter, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection...
CVE-2026-56848
A heap use-after-free vulnerability in the Node.js HTTP/2 component allows a remote attacker to crash the application, causing a denial of service. This is triggered by an unexpected re-entrant call to nghttp2sessionmemsend while nghttp2sessionmemrecv is still executing. Mitigation Restrict netwo...
CVE-2026-54207 TeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in move archive functionality
Tobit Laboratories AG TeamDavid's Webbox 's move archive functionality “!ArcEntryMove” accepts an arbitrary path, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection attempts to...
CVE-2026-54206 TeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in sending functionality
Tobit Laboratories AG TeamDavid's Webbox 's sending email, fax, SMS, etc. functionality accepts a @@INCLUDE command, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection attempts to...
EUVD-2026-54437
Tobit Laboratories AG TeamDavid's Webbox 's sending email, fax, SMS, etc. functionality accepts a @@INCLUDE command, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection attempts to...
net: openvswitch: reject oversized nested action attrs
...
MGASA-2026-0325 Updated rootcerts, nss & firefox packages fix security vulnerabilities
Updated rootcerts, nss & firefox packages fixes various vulnerabilities. Please see the links for detailed information of each one...
Updated rootcerts, nss & firefox packages fix security vulnerabilities
Updated rootcerts, nss & firefox packages fixes various vulnerabilities. Please see the links for detailed information of each one...
OESA-2026-3268 libevent security update
Libevent additionally provides a sophisticated framework for buffered network IO, with support for sockets, filters, rate-limiting, SSL, zero-copy file transmission, and IOCP. Libevent includes support for several useful protocols, including DNS, HTTP, and a minimal RPC framewor. Security Fixes:...
EUVD-2026-54313
Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate privileges over a network...
EUVD-2026-54325
Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elevate privileges over a network...
EUVD-2026-54322
Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network...
EUVD-2026-54316
Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network...
EUVD-2026-54314
Improper authorization in Microsoft Power Apps allows an unauthorized attacker to elevate privileges over a network...
EUVD-2026-54312
Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over a network...
EUVD-2026-54323
Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network...
EUVD-2026-54318
Improper limitation of a pathname to a restricted directory 'path traversal' in Application Insights Profiler allows an authorized attacker to elevate privileges over a network...
EUVD-2026-54321
Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network...