1734 matches found
CVE-2026-20473
The CVE-2026-20473 entry describes a memory corruption via use-after-free in the display path that could enable local privilege escalation if the attacker already holds System privileges. Exploitation reportedly does not require user interaction. The public documents note a patch ID: ALPS11019722...
EUVD-2026-51944
The Narrative Publisher WordPress plugin through 1.0.7 does not restrict write access to a REST-exposed post meta field or escape it when rendering, allowing users with contributor-level access and above to store JavaScript that executes in the browser of any higher-privileged user who views the...
CVE-2026-15151
The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions, allowing users with the lowest booking-management role which by default cannot access the Five Star Restaurant Reservations WordPress plugin before 2.7.23's setting...
CVE-2026-1918 IBM Sterling B2B Integrator and IBM Sterling File Gateway store sensitive information in a log file
IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.52, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.52, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 stores potentially sensitive information in log files that could be read by a...
CVE-2026-1918
IBM Sterling B2B Integrator and IBM Sterling File Gateway versions 6.2.0.0–6.2.0.5_2, 6.2.1.0–6.2.1.1_2, and 6.2.2.0–6.2.2.0_1 store potentially sensitive information in log files that could be read by a privileged user (CWE-532). CVSSv3.1 base score 4.9 (ATT&CK/impact details not indicating expl...
CVE-2026-7775
IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 is vulnerable to stored cross-site scripting. This vulnerability allows a...
CVE-2026-58246 Information Disclosure vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform
SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifier information into a diagnostic trace when the trace is activated by a privileged user. An attacker with access to the resulting trace data could obtain identifiers that allow impersonation of legitimate...
GHSA-4R2P-27MH-5M22 Open WebUI: Stored web worker XSS via Pyodide
Title: Same-origin Pyodide code execution allows server-side RCE via a shared chat Summary Open WebUI runs client-side Python Pyodide in a same-origin web worker. Through Pyodide's JavaScript API pyodide.http.pyfetch, or the js module which exposes the page's fetch / XMLHttpRequest executed Pytho...
EUVD-2026-42350
LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks...
PT-2026-63368
Open Mercato does not validate regex rules. An attacker with privileges to create the regex rule can add an unsafe regex to a field. When someone provide the proper string it can result in a DoS attack. This issue was fixed in version 0.6.4...
PT-2026-62095
Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An inconsistency in the file access authorization logic allows a low-privileged authenticated user to retrieve, modify, and delete case attachments from feature areas they are not authorized t...
CVE-2025-71394
SurrealDB versions before 2.2.2 contain a local file read vulnerability in the DEFINE ANALYZER statement that allows authenticated users to read arbitrary files on the file system. Attackers with root, namespace, or database level privileges can point analyzers to arbitrary file paths and...
CVE-2025-71394
SurrealDB versions before 2.2.2 have a local file read vulnerability in the DEFINE ANALYZER that allows authenticated users with root, namespace, or database privileges to point analyzers to arbitrary file paths and exfiltrate content from two-column tab-separated files; remediation is to upgrade...
CVE-2025-71394 SurrealDB before 2.2.2 Local File Read via DEFINE ANALYZER
SurrealDB versions before 2.2.2 contain a local file read vulnerability in the DEFINE ANALYZER statement that allows authenticated users to read arbitrary files on the file system. Attackers with root, namespace, or database level privileges can point analyzers to arbitrary file paths and...
CVE-2026-41154
CVE-2026-41154 : The issue affects the GPU DDK in the CMA Cleanup Path of AllocOSPages_Sparse. When indexing pages larger than 4kB in the sparse memory page-freeing logic, an incorrect buffer indexing leads to out-of-bounds (OOB) reads/writes in kernel memory, exposed to software running as a non...
PT-2026-56660
Name of the Vulnerable Software and Affected Versions Ray Enterprise Translation versions 0.0.0 through 4.0.4 Ray Enterprise Translation versions 4.1.0 through 4.1.4 Ray Enterprise Translation versions 11.0.0 through 11.0.4 Description Cross-Site Request Forgery CSRF occurs when a module fails to...
Ray Enterprise Translation - Moderately critical - Cross site request forgery - SA-CONTRIB-2026-071
The Lingotek Ray Enterprise Translation module provides multilingual site management. The module fails to protect several state-changing administrative routes against Cross Site Request Forgery attacks. An attacker could trick a privileged user into visiting a crafted page that triggers actions...
AI SEO/GEO Analyzer - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-076
The AI SEO/GEO Analyzer module generates SEO/GEO analysis reports by sending content of an entity including its comments to an LLM, then converts the model's Markdown response to HTML and stores it for display to privileged users. The generated HTML was rendered without passing through Drupal's...