14951 matches found
EUVD-2026-29843
efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the elfindercheckRisk function validates target and targets for path traversal and home containment, but does not validate the dst destination parameter used by elfinderpaste. An attacker can copy or move files from within the home...
CVE-2026-44258 efw4.X: Path Traversal via Unchecked dst Parameter leads to Remote Code Execution
efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the elfindercheckRisk function validates target and targets for path traversal and home containment, but does not validate the dst destination parameter used by elfinderpaste. An attacker can copy or move files from within the home...
PT-2026-41382
Уязвимость компонента BitLocker операционных систем Windows связана с нарушением механизма защиты данных. Эксплуатация уязвимости может позволить нарушителю получить несанкционированный доступ к защищаемой информации...
ROS-20260512-73-0022
A vulnerability in the Core component of the Oracle VM VirtualBox virtual machine is related to insufficient input validation. Exploitation of the vulnerability could allow an attacker to gain access to read, modify, or delete protected information...
ROS-20260512-73-0021
A vulnerability in the Core component of the Oracle VM VirtualBox virtual machine is related to insufficient input validation. Exploitation of the vulnerability could allow an attacker to gain access to read, modify, or delete protected information...
ROS-20260512-73-0033
Vulnerability in ruby related to lack of protection of proprietary data. Exploitation of the vulnerability may allow a remote attacker to gain unauthorized access to protected information...
ROS-20260512-73-0009
Vulnerability in beats related to unchecked array indexing. Exploitation of the vulnerability may allow an attacker to affect confidentiality, integrity and availability of protected information...
The vulnerability of the Business Chat function in Microsoft 365 Copilot allows a hacker to disclose protected information.
The vulnerability of the Business Chat function in Microsoft 365 Copilot is related to incorrect elimination of special elements in output data. Exploiting this vulnerability can allow an attacker, operating remotely, to disclose protected information...
The vulnerability of the intermediate software StripPrefixRegex of the Containous Traefik reverse proxy server allows a hacker to access protected information.
The vulnerability of the intermediate software program StripPrefixRegex of the Containous Traefik reverse proxy server is related to the use of a name with an incorrect link. Exploiting this vulnerability can allow a remote attacker to gain access to protected information...
The vulnerability of the respond_request() function in the system for launching and managing large language models of LoLLMS (Lord of Large Language Multimodal Systems) allows a malicious actor to gain unauthorized access to protected information.
The vulnerability of the respondrequest function in the system for launching and managing large language models of LoLLMS is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to...
The vulnerability of the intermediate software ForwardAuth in the reverse proxy server Containous Traefik allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the intermediate software ForwardAuth in the reverse proxy server Containous Traefik is related to insufficient verification of data authenticity. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...
The vulnerability of the Business Chat function in the Microsoft 365 Copilot intelligent virtual assistant allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the Business Chat function in Microsoft 365 Copilot relates to the failure to take measures to neutralize special elements. Exploiting this vulnerability may allow a malicious actor, operating remotely, to gain unauthorized access to protected information...
CVE-2026-43885
WWBN AVideo is an open source video platform. In versions up to and including 29.0, an unauthenticated user can read APISecret from objects/plugins.json.php and use it to call protected API endpoints e.g. userslist without logging in. Commit 1c36f229d0a103528fb9f64d0a1cc0e1e8f5999b contains an...
EUVD-2026-29298
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.5. An app may be able to access protected user data...
EUVD-2026-29247
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.5. An app may be able to access protected user data...
EUVD-2026-29233
A denial of service issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to modify protected parts of the file system...
CVE-2026-43652
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.5. An app may be able to access protected user data...
CVE-2026-28930
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.5. An app may be able to access protected user data...
CVE-2026-28908
A denial of service issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to modify protected parts of the file system...
CVE-2026-43885 WWBN AVideo: Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization
WWBN AVideo is an open source video platform. In versions up to and including 29.0, an unauthenticated user can read APISecret from objects/plugins.json.php and use it to call protected API endpoints e.g. userslist without logging in. Commit 1c36f229d0a103528fb9f64d0a1cc0e1e8f5999b contains an...