EUVD-2026-24209

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to 5.0.5, ClearanceKit incorrectly treats a process with an empty Team ID and a non-empty Signing ID as an Apple platform binary. This bug allows a malicious software to impersonate an apple...

ClearanceKit 安全漏洞

ClearanceKit is a macOS file system access control tool developed by Craig J. Bass. Versions of ClearanceKit prior to 5.0.5 contained security vulnerabilities. These vulnerabilities stemmed from improper handling of Team IDs and Signing IDs, allowing malware to impersonate Apple processes and...

PT-2026-36923

Name of the Vulnerable Software and Affected Versions Nginx UI versions prior to 2.3.8 Description The GetSettings API handler in the api/settings/settings.go file serializes all settings structs to JSON and returns them to authenticated users. While many sensitive fields are marked as protected,...

Radware Alteon has a reflected XSS vulnerability that can execute JavaScript in the host browser

Overview Radware Alteon has a reflected Cross-Site Scripting XSS vulnerability in the parameter ReturnTo of the route /protected/login. This vulnerability allows an attacker to execute JavaScript in the host browser. Description CVE-2026-5754: Reflected Cross-Site Scripting XSS vulnerability in...

CVE-2026-29642

A local attacker who can execute privileged CSR operations or can induce firmware to do so performs carefully crafted reads/writes to menvcfg e.g., csrrs in M-mode. On affected XiangShan versions commit aecf601e803bfd2371667a3fb60bfcd83c333027, 2024-11-19, these menvcfg accesses can unexpectedly...

ROS-20260420-73-0025

Vulnerability in python-aiohttp related to lack of service data protection. Exploitation of the vulnerability may allow a remote attacker to gain unauthorized access to protected information...

ROS-20260420-73-0036

Vulnerability in mediawiki due to lack of protection for proprietary data. Exploitation of the vulnerability could allow a remote attacker to gain unauthorized access to protected information...

The vulnerability of the strlen() function in thejq programming language allows attackers to influence the integrity and accessibility of the protected information.

The vulnerability of the strlen function in thejq programming language is related to errors that occur when a string or array is terminated with a NULL character. Exploiting this vulnerability can allow an attacker to influence the integrity and accessibility of the protected information...

The vulnerability of the Jenkins automation server lies in the lack of protection for service data, allowing attackers to gain unauthorized access to the protected information.

The vulnerability of the Jenkins automation server lies in the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to protected information...

The vulnerability of the rewriteRequestHeaders() function in the Fastify framework, a Node.js software platform, allows a malicious actor to gain unauthorized access and modify protected information.

The vulnerability of the rewriteRequestHeaders function in the Fastify framework, a Node.js software platform, is related to HTTP request processing flaws. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access and modify protected information...

The vulnerability of the graphical user interface of the software solution for coordinating the operation of cybersecurity systems and for managing real-time incident responses in Fortinet FortiSOAR allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the graphical user interface of the software solution for coordinating the operation of cybersecurity systems and for managing real-time incident responses in Fortinet FortiSOAR is related to the transmission of critical information in open text. Exploiting this vulnerability...

The vulnerability of the cupsd server daemon in the CUPS printing system allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the cupsd server printing service in CUPS is related to deficiencies in the authentication process. Exploiting this vulnerability allows an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability in the implementation of the WebUSB protocol of Google Chrome allows a perpetrator to disclose protected information.

The vulnerability of the WebUSB protocol implementation in Google Chrome browser is related to a potential overflow condition. Exploiting this vulnerability could allow an attacker to disclose sensitive information through a specially created HTML page...

The vulnerability of the FFmpeg multimedia library, related to integer overflows, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the FFmpeg multimedia library is related to a potential overflow condition. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability of the FortiSandbox threat detection and mitigation system, related to the use of files and directories accessible from external parties, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the FortiSandbox threat detection and mitigation system lies in the use of files and directories accessible from external parties. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...

The vulnerability of the Windows Shell component of the Windows operating system allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Windows Shell component of the Windows operating system is related to the disclosure of information. Exploiting this vulnerability can allow an attacker, working remotely, to gain unauthorized access to protected information...

The vulnerability of the Apache Airflow network software lies in the improper assignment of permissions for critical resources, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the Apache Airflow network software relates to the improper assignment of permissions for critical resources. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the Mattermost instant messaging application, related to the lack of authentication, allows a malicious user to gain unauthorized access and modify protected information.

The vulnerability of the Mattermost instant messaging application is related to the lack of authentication. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access and modify protected information...

The vulnerability of the ip6addrlbl_putmsg() function in the net/ipv6/addrlabel.c module of the Linux operating system’s IPv6 kernel implementation allows a attacker to access protected information or cause a service failure.

The vulnerability of the ip6addrlblputmsg function in the net/ipv6/addrlabel.c module of the Linux operating system’s IPv6 kernel implementation is related to access to an uninitialized pointer. Exploiting this vulnerability could allow an attacker to gain access to protected information or cause...

The vulnerability of the monitoring and surveillance system of the Grafana platform allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the monitoring and surveillance platform for Grafana relates to the disclosure of information. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...