29286 matches found
CVE-2025-59108
By default, the password for the Access Manager's web interface, is set to 'admin'. In the tested version changing the password was not enforced...
CVE-2025-13881
A flaw was found in Keycloak Admin API. This vulnerability allows an administrator with limited privileges to retrieve sensitive custom attributes via the /unmanagedAttributes endpoint, bypassing User Profile visibility settings. Mitigation Mitigation for this issue is either not available or the...
Arbitrary Code Injection
Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the PNGImageEncoder process. An attacker can execute arbitrary code by supplying crafted input that is improperly handled during image encoding. Remediation A fix was pushed into the master branch but not ye...
CVE-2026-24825
CVE-2026-24825 describes a memory-leak issue in the ydb-platform/ydb stack, linked to the contrib/libs/yajl modules (yail_tree.C). Affected are ydb versions up to 24.4.4.2. The vulnerability is characterized as Missing Release of Memory after Effective Lifetime, with impact described as potential...
CVE-2026-24800
Out-of-bounds Write, Buffer Copy without Checking Size of Input 'Classic Buffer Overflow' vulnerability in tildearrow furnace extern/zlib modules. This vulnerability is associated with program files inflate.C...
MAL-2026-536 Malicious code in morgan.js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34775085e6638773de4ccac41092ae9954c9889f2c2a7bcd7cb7909375b53c4c The package morgan.js was found to contain malicious code. Source: ghsa-malware 6d6ee3da39907b410bc3a7d0baf6736a9c9c2f1c770a6e749c5ad2119c848d9f Any...
CVE-2026-1407
A security flaw has been discovered in Beetel 777VR1 up to 01.00.09/01.00.0955. This affects an unknown part of the component UART Interface. Performing a manipulation results in information disclosure. The attack may be carried out on the physical device. The attack is considered to have high...
Out-of-bounds Write
Overview Affected versions of this package are vulnerable to Out-of-bounds Write via the gbase64encodeclose function. An attacker can cause memory corruption or application crashes by providing excessively large or untrusted input data. Remediation A fix was pushed into the master branch but not...
UBUNTU-CVE-2025-69420
Issue summary: A type confusion vulnerability exists in the TimeStamp Response verification code where an ASN1TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing a malformed TimeStamp Response file. Impact summary: An...
EUVD-2026-4658
pnpm is a package manager. Prior to version 10.28.2, when pnpm installs a file: directory or git: dependency, it follows symlinks and reads their target contents without constraining them to the package root. A malicious package containing a symlink to an absolute path e.g., /etc/passwd,...
CVE-2025-59103
The Access Manager 92xx in hardware revision K7 is based on Linux instead of Windows CE embedded in older hardware revisions. In this new hardware revision it was noticed that an SSH service is exposed on port 22. By analyzing the firmware of the devices, it was noticed that there are two users...
EUVD-2025-206368
By default, the password for the Access Manager's web interface, is set to 'admin'. In the tested version changing the password was not enforced...
PT-2026-4758
By default, the password for the Access Manager's web interface, is set to 'admin'. In the tested version changing the password was not enforced...
PT-2026-4753
Name of the Vulnerable Software and Affected Versions Access Manager 92xx hardware revision K7 affected versions not specified Description The Access Manager 92xx hardware revision K7 utilizes a Linux-based operating system, differing from older revisions that used Windows CE. An SSH service is...
PT-2026-4750
The web interface offers a functionality to export the internal SQLite database. After executing the database export, an automatic download is started and the device reboots. After rebooting, the exported database is deleted and cannot be accessed anymore. However, it was noticed that sometimes t...
PT-2026-4678
A weakness has been identified in Beetel 777VR1 up to 01.00.09/01.00.09 55. This vulnerability affects unknown code of the component UART Interface. Executing a manipulation can lead to weak password requirements. The physical device can be targeted for the attack. The attack requires a high leve...
PT-2026-4699
Name of the Vulnerable Software and Affected Versions Android Framework affected versions not specified Description Improper input validation in multiple functions of AccessibilityManagerService.java can lead to a persistent local denial of service. This issue does not require additional executio...
CVE-2026-0756
github-kanban-mcp-server execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of github-kanban-mcp-server. Authentication is not required to exploit this vulnerability. The specific flaw...