52299 matches found
Pega Platform 安全漏洞
Pega Platform is an enterprise management platform developed by Pega, Inc. Versions of Pega Platform from 8.1.0 to 25.1.0 have security vulnerabilities. These vulnerabilities stem from cross-site scripting vulnerabilities in the user interface components, which may compromise confidentiality...
HCL Aftermarket DPC SQL Injection Vulnerability
HCL Aftermarket DPC is a digital spare parts and aftermarket management platform for HCL India. HCL Aftermarket DPC suffers from a SQL injection vulnerability that stems from the application's lack of validation of externally entered SQL statements, which can be exploited by an attacker to execut...
WWBN AVideo 安全漏洞
WWBN AVideo is a video platform building system developed by the WWBN team using PHP. Versions of WWBN AVideo prior to 26.0 contained security vulnerabilities. These vulnerabilities stemmed from a lack of administrator permission checks at the plugin/YPTWallet/view/users.json.php endpoint, which...
Unspecified Vulnerability in HCL Aftermarket DPC (CNVD-2026-15828)
HCL Aftermarket DPC is a digital spare parts and aftermarket management platform for HCL India. HCL Aftermarket DPC has a security vulnerability that can be exploited by an attacker to get a clearer picture of the organization's network layout...
RHEL 9 : Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update (Important) (RHSA-2026:6277)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:6277 advisory. Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Manager...
CVE-2026-33986
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in yuvensurebuffer in libfreerdp/codec/h264.c, h264-width and h264-height are updated before the reallocation loop. If any winpralignedrecalloc call fails, the function returns FALSE but width/height are...
CVE-2026-33985
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, pixel data from adjacent heap memory is rendered to screen, potentially leaking sensitive data to the attacker. This issue has been patched in version 3.24.2...
CVE-2026-27599 CI4MS: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input within System Settings – Mail Settings. Several configuration...
CVE-2026-27599
CI4MS (CodeIgniter 4-based CMS skeleton) is affected by a stored DOM XSS in System Settings – Mail Settings. Prior to version 0.31.0.0, fields such as Mail Server, Mail Port, Email Address, Email Password, Mail Protocol and TLS settings accept attacker-controlled input that is stored server-side ...
GHSA-442J-39WM-28R2 vulnerabilities
Vulnerabilities for packages: rancher-api-ui, opensearch-dashboards, py3-jupyterlab, ts-patch, prism, lerna...
perl: stack-based crash in S_find_uninit_var()
A stack-based buffer overflow vulnerability was found in the Sfinduninitvar function in sv.c in Perl. This issue may allow an authenticated local attacker to send a specially crafted request to the application, leading to an infinite recursion, exhausting the process' stack space, resulting in a...
CVE-2026-34714
Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %expr injection occurs with tabpanel lacking PMLE...
GHSA-PM37-62G7-P768 AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page
Summary The YPTWallet Stripe payment confirmation page directly echoes the $REQUEST'plugin' parameter into a JavaScript block without any encoding or sanitization. The plugin parameter is not included in any of the framework's input filter lists defined in security.php, so it passes through...
EUVD-2026-16748
AVideo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password Verification...
EUVD-2026-16719
AVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket...
EUVD-2026-17199
ci4-cms-erp/ci4ms: System Settings Mail Settings Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS...
CVE-2026-23409 affecting package kernel for versions less than 6.6.130.1-1
CVE-2026-23409 affecting package kernel for versions less than 6.6.130.1-1. A patched version of the package is available...
CVE-2026-23370 affecting package kernel for versions less than 6.6.130.1-1
CVE-2026-23370 affecting package kernel for versions less than 6.6.130.1-1. An upgraded version of the package is available that resolves this issue...
CVE-2025-71233 affecting package kernel for versions less than 6.6.130.1-1
CVE-2025-71233 affecting package kernel for versions less than 6.6.130.1-1. An upgraded version of the package is available that resolves this issue...