181 matches found
CLSA-2026-1784250520 TuxCare security update for lodash (4 CVEs)
TuxCare rebuilt lodash to address 4 CVEs. Fixed in 4.17.11-tuxcare.1...
CLSA-2026-1778633139 TuxCare security update for lodash (3 CVEs)
TuxCare rebuilt lodash to address 3 CVEs. Fixed in 4.17.21-tuxcare.1...
CVE-2026-62323
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, ViewerSessionValidation uses only the session-id prefix of a WOPI access token and does not enforce the requested viewer action, allowing a malicious or compromised WOPI viewer with a view session to forge the token...
CVE-2026-27064
Editor Arbitrary File Upload in Mailster = 4.1.17 versions...
CVE-2026-6952
A post-authentication command injection vulnerability in the "LogServer" field of the syslog component in Zyxel AX7501-B1 firmware versions through 5.17ABPC.7.2C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device...
CLEANSTART-2026-CT15102 Security fixes for CVE-2026-42504 applied in versions: 2.17.0-r3
Security vulnerability affects the kube-state-metrics package. This issue is resolved in later releases. See references for vulnerability details...
PYSEC-2026-893 pgadmin4 vulnerable to Code Injection
The pgAdmin server includes an HTTP API that is intended to be used to validate the path a user selects to external PostgreSQL utilities such as pgdump and pgrestore. The utility is executed by the server to determine what PostgreSQL version it is from. Versions of pgAdmin prior to 6.17 failed to...
WordPress Shortcodes and extra features for Phlox theme plugin <= 2.17.21 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by timomangcut in WordPress Plugin Shortcodes and extra features for Phlox theme versions = 2.17.21...
EUVD-2026-40850
Oj Optimized JSON is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, Oj.dump is vulnerable to a stack-based buffer overflow when a large :indent value is provided by the developer. fillindent in dump.h calls memsetindentstr, ' ', sizetopts-indent without...
PT-2026-51179
GNU Savannah Administration Savane through 3.17 uses untrusted data as part of authorization...
CVE-2026-48137
There is an untrusted pointer dereference vulnerability in the NI grpc-device sideband streaming API that may allow an attacker to cause an arbitrary memory dereference, potentially resulting in remote code execution. Successful exploitation requires an attacker to supply a specially...
EUVD-2026-38032
There is an incorrect conversion between numeric types vulnerability in NI grpc-device due to missing range checks in CodeGen. This may silently discard high bits if a size value exceeded the target type's range. This affects NI grpc-device 2.17.0 and prior versions...
CVE-2026-48140 Unchecked enum cast vulnerability in NI grpc-device in BeginSidebandStream
There is an unchecked enum cast vulnerability in NI grpc-device BeginSidebandStream that may allow an attacker to trigger invalid enum states and undefined behavior, potentially resulting in a denial of service. Successful exploitation requires an attacker to supply a specially crafted message...
PT-2026-50892
Name of the Vulnerable Software and Affected Versions NI grpc-device versions prior to 2.17.0 Description A memory leak exists in the BeginSidebandStream function, which can lead to a denial of service condition caused by memory exhaustion. Recommendations Update to a version later than 2.17.0. A...
EUVD-2025-210178
Unauthenticated Local File Inclusion in WineShop = 3.17 versions...
CVE-2025-69162
Unauthenticated Local File Inclusion in Grecko = 5.17 versions...
EUVD-2026-37003
Unauthenticated Cross Site Scripting XSS in SEO Redirection = 9.17 versions...
PT-2026-49392
Unauthenticated Cross Site Scripting XSS in Paid Member Subscriptions = 2.17.3 versions...
CVE-2026-33212
Weblate is a web based localization tool. In versions prior to 5.17, the tasks API didn't verify user access for pending tasks. This could expose logs of in-progress operations to users who don't have access to given scope. The attacker needs to brute-force the random UUID of the task, so...