28836 matches found
EUVD-2026-10403
node-tar Symlink Path Traversal via Drive-Relative Linkpath...
EUVD-2026-10891
zot’s create-only policy allows overwrite attempts of existing latest tag update permission not required...
WordPress 6.9-6.9.3 - Broken Access Control in Notes vulnerability
Broken Access Control in Notes vulnerability discovered by kaminuma in WordPress core versions 6.9-6.9.3...
WordPress WP ULike plugin <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attribute vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode Attribute vulnerability discovered by Quốc Huy jtwings - Puramu in WordPress Plugin WP ULike versions = 5.0.1...
CVE-2026-23209 affecting package kernel for versions less than 6.6.126.1-1
CVE-2026-23209 affecting package kernel for versions less than 6.6.126.1-1. A patched version of the package is available...
CVE-2025-38011 affecting package kernel for versions less than 6.6.126.1-1
CVE-2025-38011 affecting package kernel for versions less than 6.6.126.1-1. A patched version of the package is available...
CVE-2025-71235 affecting package kernel for versions less than 6.6.126.1-1
CVE-2025-71235 affecting package kernel for versions less than 6.6.126.1-1. A patched version of the package is available...
CVE-2025-58190 affecting package keda for versions less than 2.14.1-11
CVE-2025-58190 affecting package keda for versions less than 2.14.1-11. A patched version of the package is available...
CVE-2026-31832
Umbraco (ASP.NET CMS) has a broken object-level authorization vulnerability in backoffice API endpoints affecting 14.0.0–before 16.5.1 and 17.2.2. An authenticated user can assign domain-related data to content nodes without proper authorization checks due to insufficient enforcement on the affec...
EUVD-2025-208519
A Stored Cross-Site Scripting XSS vulnerability exists in the PluXml article comments feature for PluXml versions 5.8.22 and earlier. The application fails to properly sanitize or validate user-supplied input in the "link" field of a comment. An attacker can inject arbitrary JavaScript code using...
EUVD-2026-10388
ImageMagick has a heap buffer over-read via 32-bit integer overflow in MAT decoder...
Out-of-bounds Read
Overview Magick.NET-Q8-OpenMP-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package...
Out-of-bounds Read
Overview Magick.NET-Q16-HDRI-x86 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...
Deserialization of Untrusted Data
Overview limesurvey/limesurvey is a FOSS online survey tool on the web. Affected versions of this package are vulnerable to Deserialization of Untrusted Data through the decodeTokenAttributes helper. An attacker can achieve remote code execution by supplying a malicious serialized token attribute...
CVE-2026-29793 NoSQL Injection via WebSocket id Parameter in MongoDB Adapter
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0 to before 5.0.42, Socket.IO clients can send arbitrary JavaScript objects as the id argument to any service method get, patch, update, remove. The transport layer performs no type...
CVE-2026-21365
Substance3D - Painter versions 11.1.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to access sensitive information stored in memory. Exploitation of this issue requires user interaction in that a...
CVE-2026-21364 Substance3D - Painter | NULL Pointer Dereference (CWE-476)
Substance3D - Painter versions 11.1.2 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application, causing disruption to services. Exploitation of this issue requires...
CVE-2026-27273
Substance3D Stager is affected by CVE-2026-27273 (out-of-bounds write) in versions up to 3.1.7. The vulnerability could allow arbitrary code execution in the context of the current user and requires user interaction (victim must open a malicious file). Remediation is provided in APSB26-29, which ...
Incorrect Default Permissions
Overview Affected versions of this package are vulnerable to Incorrect Default Permissions. An attacker can gain elevated privileges by exploiting these permissions locally. Remediation Upgrade Microsoft.NETCore.App.Runtime.linux-arm64 to version 10.0.4 or higher. References - Vulnerability Advis...