705 matches found
Astra Linux - Vulnerability in libxml2
parser.c in libxml2 prior to version 2.9.5 does not prevent infinite recursion in parameter entities...
CVE-2026-32227
SQL Injection vulnerability vulnerability in Apache Ranger. This issue affects . Users are recommended to upgrade to version 2.9.0, which fixes the issue...
EUVD-2026-55249
Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger = 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue...
EUVD-2026-55247
TLS hostname verification issue in Apache Ranger Client Code in versions = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...
SUSE CVE-2026-70628
FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsubparser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard...
Linux Distros Unpatched Vulnerability : CVE-2026-71478
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link...
EUVD-2026-54261
league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link filter can be bypassed by embedding control bytes, such as a tab, carriage return, line feed, or leading C0 control character, in a...
CVE-2026-65578
Unauthenticated PHP Object Injection in Agora = 1.9 versions...
CVE-2026-15006 Bit integrations <= 2.9.0 - Unauthenticated Arbitrary File Read via Optional CF7 File Field
The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.0 via the processAttachment function. This makes it possible for unauthenticated attackers to read the...
EUVD-2026-51689
The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.0 via the processAttachment function. This makes it possible for unauthenticated attackers to read the...
CLEANSTART-2026-QJ89264 Security fixes in wave-fips 0.9.0-r3
Package wave-fips version 0.9.0-r3 fixes 23 vulnerabilities: CVE-2025-68121, CVE-2025-61726, CVE-2025-61728, CVE-2025-61729, CVE-2026-25679...
EUVD-2026-50967
The Admin and Site Enhancements ASE Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.9.0 via the recursivehtml function. This is due to the frontend save handler enforces only a publicly emitted nonce with no authentication check, CAPTCHA...
CVE-2026-13697
undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and...
Cedar-Java has policy injection, type confusion, and incorrect equality comparison vulnerabilities
Summary CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. Under certain circumstances, it could lead to incorrect equality comparisons. Impact EntityIdentifier.equals has inverted null/self branches The...
CVE-2026-59538
Unauthenticated SQL Injection in GamiPress = 7.9.7 versions...
CVE-2026-16870 Multiple Security Vulnerabilities in Snowflake libsnowflakeclient
Multiple security vulnerabilities in Snowflake libsnowflakeclient versions prior to 2.9.2 could allow remote code execution and credential exfiltration. A stack-based buffer overflow in the file download path could allow remote code execution on a victim host. An attacker could exploit this by...
EUVD-2026-48425
Victor SSRF vulnerability in Johnson Controls CCure 9000 and victor application server allows Server Side Request Forgery. This issue affects CCure 9000 and victor application server: from 2.9 through 3.0...
CVE-2026-47670 DbGate Vulnerable to Authenticated Remote Code Execution via loadReader functionName code injection
DbGate is cross-platform database manager. Versions 7.1.8 and prior are vulnerable to authenticated Remote Code Execution RCE. Any user with valid DbGate credentials can execute arbitrary OS commands as root by exploiting an unsanitized functionName parameter in the /runners/load-reader endpoint...
PT-2026-64169
Name of the Vulnerable Software and Affected Versions Johnson Controls CCure 9000 and victor application server versions 2.9 through 3.0 Description A Server Side Request Forgery SSRF issue exists in the Victor application server. SSRF is a flaw that allows an attacker to induce the server-side...
