123197 matches found
CVE-2026-16955 AI Engine < 3.6.6 - Subscriber+ Arbitrary File Read via Audio Transcription
The AI Engine WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and forwarding the contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host. Reaching the issue at...
EUVD-2026-54745
The AI Engine WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and forwarding the contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host. Reaching the issue at...
EulerOS 2.0 SP11 : krb5 (EulerOS-SA-2026-3072)
According to the versions of the krb5 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In MIT Kerberos 5 aka krb5 before 1.22.3, there is a NULL pointer dereference if an application calls gssacceptseccontext on a system with a NegoEx...
openSUSE 16 Security Update : libXfont2 (openSUSE-SU-2026:21539-1)
The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21539-1 advisory. - CVE-2026-44950: fsreadglyphs heap buffer overflow via cumulative glyph data overflow bsc1272661. - CVE-2026-59679: fsreadglyphs heap OOB...
PT-2026-69193
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The decode lockers function in cls lock client.c contains two unsafe decode operations that allow a malicious or compromised Object Storage Device OSD to trigger slab-out-of-bounds reads...
CVE-2026-11743
The SF32LB MPI QSPI NOR flash driver drivers/flash/flashsf32lbmpiqspinor.c validated the flash offset and length on its read and write paths with the test offset + size data-size. Because offset is a signed offt while size is unsigned, a negative offset is converted to a large unsigned value and...
CVE-2026-47663
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's typed CRUD/search/batch FHIR surface allows an authenticated caller with only coarse operation authorities to act on...
CVE-2026-47662
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's typed CRUD/search/batch FHIR surface allows an authenticated caller with only coarse operation authorities to act on...
EUVD-2026-54682
The SF32LB MPI QSPI NOR flash driver drivers/flash/flashsf32lbmpiqspinor.c validated the flash offset and length on its read and write paths with the test offset + size data-size. Because offset is a signed offt while size is unsigned, a negative offset is converted to a large unsigned value and...
CVE-2026-11743
The CVE concerns the SF32LB MPI QSPI NOR flash driver (drivers/flash/flash_sf32lb_mpi_qspi_nor.c). The vulnerability arises in the read/write paths where a signed offset (off_t) is compared against an unsigned size using (offset + size) > data->size, allowing a negative offset to wrap to a ...
Security Bulletin: Consul vulnerable to partial arbitrary file read via Vault Connect CA provider
Summary Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect CA provider with JWT or AppRole authentication. A privileged attacker with operator:write permission may direct Consul to read and...
CVE-2026-47663
Pathling Server before 2.0.0 allowed an authenticated caller with only coarse operation authorities to act on attacker-chosen FHIR resource families due to insufficient per-resource read/write checks on typed CRUD/search/batch endpoints. This could enable cross-resource mutation and potential ser...
EUVD-2026-54649
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's typed CRUD/search/batch FHIR surface allows an authenticated caller with only coarse operation authorities to act on...
EUVD-2026-54648
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's typed CRUD/search/batch FHIR surface allows an authenticated caller with only coarse operation authorities to act on...
CVE-2026-47662
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's typed CRUD/search/batch FHIR surface allows an authenticated caller with only coarse operation authorities to act on...
CVE-2026-66151
SonicWall Global VPN Client version 4.10.8.1108 and earlier is vulnerable to an out-of-bounds kernel memory read in the SWIPsec.sys driver, which could allow a local attacker to cause a system crash...
CVE-2026-61808
LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read indexed document content, upload or delete documents, modi...
CVE-2026-19017
Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect CA provider with JWT or AppRole authentication. A privileged attacker with operator:write permission may direct Consul to read and forward...
DEBIAN-CVE-2026-19017
Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect CA provider with JWT or AppRole authentication. A privileged attacker with operator:write permission may direct Consul to read and forward...
UBUNTU-CVE-2026-19017
Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect CA provider with JWT or AppRole authentication. A privileged attacker with operator:write permission may direct Consul to read and forward...