114966 matches found
CVE-2026-55544
NextCRM (open-source) vulnerability CVE-2026-55544 affects version 0.12.1, where MCP campaign tools expose read/write operations over the network via user-generated Bearer tokens (nxtc__...). Despite an authorization model restricting normal users to their own campaigns, multiple MCP handlers ign...
CVE-2026-53594
Summary: CVE-2026-53594 affects FreeScout (PHP/Laravel) where the App Logs viewer can read arbitrary server files due to a flawed path resolution in the rap2hpoutre/laravel-log-viewer override. Before v1.8.224, the code accepts any existing absolute path prior to applying the storage/logs restric...
CVE-2026-53594 FreeScout has Arbitrary File Read in App Logs Viewer via Forged Encrypted Path
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout's Manage - Logs - App Logs feature uses the bundled rap2hpoutre/laravel-log-viewer override to decrypt a user-supplied file identifier and then pass the resolved path to Laravel's download response. Prior...
CVE-2026-60027
The Joomla extension Quix Page Builder Pro is vulnerable to a unauthenticated path traversal via form elements. Unauthenticated users frontend users are allowed traversal paths and read arbitrary files. Requires a published page with a Form element...
webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash
A flaw was found in WebKitGTK. Processing maliciously crafted web content can trigger an out-of-bounds read due to improper bounds checking, resulting in an unexpected process crash...
webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash
A flaw was found in WebKitGTK. Processing maliciously crafted web content can trigger an out-of-bounds read due to improper bounds checking, resulting in an unexpected process crash...
CVE-2026-60027 Joomla Extension - themexpert.com - Unauthenticated path traversal / file read in Quix Page Builder < 6.2.1
The Joomla extension Quix Page Builder Pro is vulnerable to a unauthenticated path traversal via form elements. Unauthenticated users frontend users are allowed traversal paths and read arbitrary files. Requires a published page with a Form element...
EUVD-2026-46063
The Joomla extension Quix Page Builder Pro is vulnerable to a unauthenticated path traversal via form elements. Unauthenticated users frontend users are allowed traversal paths and read arbitrary files. Requires a published page with a Form element...
CVE-2026-60027
The CVE concerns the Joomla extension Quix Page Builder Pro (pre-6.2.1 per CVE listing) and describes an unauthenticated path traversal vulnerability via form elements. An unauthenticated frontend user can traverse paths and read arbitrary files, requiring a published page containing a Form eleme...
glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"
A flaw was found in GLib. A state confusion issue exists in gdbusnodeinfonewforxml in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a element nested within other elements like , , or . This issue can cause an unsigned integer overflow and...
CVE-2026-64189
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race between dump and ipsetlist resize The release path of ipsetdumpdo and ipsetdumpdone read inst-ipsetlist via ipsetrefnetlink, a plain rcudereferenceraw of the array pointer. These run from netlinkrecvmsg...
CVE-2026-41521
xrdp is an open source RDP server. Versions 0.10.6 and prior contain an integer overflow vulnerability when processing screen update messages within the vnc-any connection mode. A malicious remote VNC server can send crafted image dimensions that cause an integer overflow during memory buffer siz...
CVE-2026-44978
Summary: xrdp versions up to 0.10.6 contain a heap out-of-bounds read in the FIPS-specific receive paths when non-default security_layer and crypt_level are used. An unauthenticated remote attacker can trigger a denial-of-service by sending a crafted FIPS-protected PDU, via a non-default mode (se...
CVE-2026-55645 xrdp: Out-of-bounds read in Client Control PDU processing (xrdp_rdp_process_data_control)
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of Client Control PDUs. During the RDP connection sequence, the parser does not perform sufficient length validation before reading specific data fields from the network stream. A remote...
CVE-2026-55645
CVE-2026-55645 affects xrdp (open source RDP server). The vulnerability is an out-of-bounds read in the processing of Client Control PDUs during the RDP connection sequence, caused by insufficient length validation in the parser before reading data from the network stream. This can allow a remote...
CVE-2026-35217
CVE-2026-35217 affects NanoMQ (MQTT v5) where a SUBSCRIBE packet can be processed even when the final 1-byte Subscription Options field is missing. A specific packet-length construction reveals two manifestations of a single parsing defect: (1) the broker may accept the malformed subscription and...
CVE-2026-58481 Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, AgentRuntime promises scoped file access under a configured sandbox basePath, but its path containment checks use raw string prefix tests. A sandbox base such as /tmp/network-ai-sandbox also matches a sibling pa...
CVE-2026-64190 net: team: fix NULL pointer dereference in team_xmit during mode change
In the Linux kernel, the following vulnerability has been resolved: net: team: fix NULL pointer dereference in teamxmit during mode change teamchangemode clears team-ops with memset before restoring safe dummy handlers via teamadjustops. A concurrent teamxmit running under RCU on another CPU can...
CVE-2026-64189
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race between dump and ipsetlist resize The release path of ipsetdumpdo and ipsetdumpdone read inst-ipsetlist via ipsetrefnetlink, a plain rcudereferenceraw of the array pointer. These run from netlinkrecvmsg...
CVE-2026-64189
The CVE-2026-64189 issue is a Linux kernel netfilter/ipset race where ip_set_dump_do() reads inst->ip_set_list without an RCU read-side critical section while a concurrent ip_set_create() can resize and free the old array. The fix adds an rcu_read_lock() around the array access to align with i...