210019 matches found
CVE-2026-19976
A security vulnerability has been detected in COMFAST CF-N1-S 2.6.0.1. Impacted is the function sub44A968 of the file /cgi-bin/mbox-config?method=SET§ion=ptestmacaddress. Such manipulation of the argument macaddress leads to command injection. The attack may be launched remotely. The exploit...
EUVD-2026-60036
A security vulnerability has been detected in COMFAST CF-N1-S 2.6.0.1. Impacted is the function sub44A968 of the file /cgi-bin/mbox-config?method=SET§ion=ptestmacaddress. Such manipulation of the argument macaddress leads to command injection. The attack may be launched remotely. The exploit...
Exploit for CVE-2026-74251
Unauthenticated SQL Injection via Attribute Filter in Phoca Ca...
PT-2026-76829
Name of the Vulnerable Software and Affected Versions Grafana affected versions not specified Description In deployments configured with multiple organizations, an Org Admin of a single organization can access permission data from other organizations. This occurs when calling the 'GET...
PT-2026-73391
Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating a Parameter Context can change parameter values that affect referencing components, but framework authorization wa...
PT-2026-76613
openssl encrypt versions before 1.4.0 contain a missing ownership verification vulnerability in the revoke key method that allows authenticated clients to revoke any other client's key. Attackers can revoke arbitrary keys by providing a valid ML-DSA signature, bypassing the intended ownership...
PT-2026-76763
A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource CR editor, to inject malicious shell commands or SQL statements. This occurs because the WORK MEM string provided in the Search CR is not properly...
PT-2026-76880
Name of the Vulnerable Software and Affected Versions Halo version 2.25.4 Description A remote attacker can execute arbitrary code through the installFromUri method within PluginEndpoint.java and the DefaultPluginApplicationContextFactory components. Recommendations At the moment, there is no...
CVE-2026-67919
Halo (open-source CMS) version 2.25.4 is vulnerable to remote code execution via the installFromUri method in PluginEndpoint.java and DefaultPluginApplicationContextFactory. The plugin installation endpoint fetches an arbitrary URL without scheme or host validation, downloads the JAR, and loads i...
PT-2026-76769
Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.2 through 18.11.10 GitLab CE/EE versions 19.0 through 19.0.7 GitLab CE/EE versions 19.1 through 19.1.5 GitLab CE/EE versions 19.2 through 19.2.3 Description Improper request validation in GraphQL multiplex query handli...
Unity Linux 20.1070e Security Update: ImageMagick (UTSA-2026-099474)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099474 advisory. ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memory...
PT-2026-73387
An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for other users. The behavior stems from an authorization check that does not correctly scope privileges...
Gitlab -- Vulnerabilities
Gitlab reports: Code Injection issue via GraphQL directive impacts GitLab CE/EE Cross-Site Request Forgery issue in GraphQL multiplex query handler impacts GitLab CE/EE...
ROS-20260817-73-0200
The vulnerability of the SetConfig method in the background service demon dnfdaemon is related to improper privilege management. Exploiting this vulnerability could allow an attacker to influence trusted package sources. Information about this vulnerability was obtained from an independent...
Unity Linux 20.1070a Security Update: osbuild-composer (UTSA-2026-101351)
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101351 advisory. gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 :pat...
Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099944)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099944 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/ioc32: stop speculation on the drmcompatioctl path The drm compat ioctl path takes a user...
PT-2026-76786
Budibase is an open-source low-code platform. Prior to 3.39.19, the PostgreSQL datasource connector in packages/server/src/integrations/postgres.ts interpolates the user-controlled schema configuration field into a SET search path statement without escaping embedded double quotes, allowing an...
PT-2026-73416
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, in OpenBao's Kerberos auth method on the GET handler, or when an Authorization: Negotiate header is supplied, the response is includes a logical.Auth object in addition to an error message. This results in...
DSPrompt: Dynamic Soft Prompt Defense against M-RAG Corruption
Multimodal Retrieval Augmented Generation M-RAG is increasingly vulnerable to adversarial attacks where malicious data are crafted to produce embeddings that align with benign entries in the vector space, deceiving retrieval and inducing harmful outputs. Existing defenses primarily operate at que...
PT-2026-73195
A security vulnerability has been detected in COMFAST CF-N1-S 2.6.0.1. Impacted is the function sub 44A968 of the file /cgi-bin/mbox-config?method=SET§ion=ptest macaddress. Such manipulation of the argument macaddress leads to command injection. The attack may be launched remotely. The exploi...