6638 matches found
CVE-2026-77652
A heap-based buffer overflow vulnerability exists in the Dia diagram editor WPG file format importer. In plug-ins/wpg/wpg-import.c, the WPG import renderer allocates a fixed palette with: ren-pPal = gnew0WPGColorRGB, 256; When handling a WPGCOLORMAP record, the parser reads a start index i16 and...
CVE-2026-57433
A flaw was found in Storable. This vulnerability allows a remote attacker to cause a denial of service DoS by providing a specially crafted data blob during deserialization. The flaw occurs due to a signed integer overflow when processing an SXHOOK record, leading to a negative count being passed...
CVE-2026-77646
creationtimestamp| type| source ---|---|--- 2026-08-21 00:01:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/coqgqpb73y2wd...
CVE-2026-55491
BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton failed to escape meetingName in record-and-playback/screenshare/playback/index.html.erb when generating the screenshare playback format. A low-privileged user could store a crafted meeting name that embedded script...
CVE-2026-55491
BigBlueButton versions prior to 3.0.29 have a stored XSS flaw: the meetingName field is rendered unescaped in record-and-playback/screenshare/playback/index.html.erb, so a low-privileged user can inject script that runs when another user replays the recording. CVSS 3.1 scores 5.4 (Medium). Upgrad...
CVE-2026-66788
creationtimestamp| type| source ---|---|--- 2026-08-20 19:30:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtjya3jrf52b 2026-08-20 20:08:56+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtk2fjde2k25...
CVE-2026-53424
creationtimestamp| type| source ---|---|--- 2026-08-20 19:10:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtjx4cg2wl2j 2026-08-20 20:07:37+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtk2d66bz72e...
CVE-2026-19683
CVE-2026-19683 affects TP-Link Omada Gateways: DDNS credentials are sent over an unencrypted channel, exposing them to network observers who could steal credentials or tamper with DNS records. Exploitation requires DDNS to be configured and an attacker on the path. No patch or exploit details are...
PT-2026-79192
Name of the Vulnerable Software and Affected Versions BigBlueButton versions prior to 3.0.29 Description An issue exists where the software fails to escape the meetingName variable in the record-and-playback/screenshare/playback/index.html.erb file during the generation of the screenshare playbac...
CVE-2026-55703 Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET
Snipe-IT is an IT asset/license management system. Prior to 8.6.3, any activated account can request /maintenances/id and read maintenance records for assets in the same company without asset or maintenance permission. app/Http/Controllers/MaintenancesController.php show renders the record withou...
CVE-2026-55703
Snipe-IT (IT asset/license management system) prior to 8.6.3 contains an authorization bypass in MaintenancesController::show(). The method renders a maintenance record without calling authorize(), unlike all sibling actions (index, edit, update, destroy) which properly gate on the asset. Any act...
CVE-2026-18031
creationtimestamp| type| source ---|---|--- 2026-08-19 18:20:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mthdtwbfbk2j...
CVE-2026-18937
creationtimestamp| type| source ---|---|--- 2026-08-19 17:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mthaimwkjn2c...
CVE-2026-13175
The Eventin WordPress plugin before 4.1.21 does not verify ownership before allowing schedule records to be modified or deleted, allowing users with contributor-level access and above to alter or delete schedule entries created by other users...
CVE-2026-73924
creationtimestamp| type| source ---|---|--- 2026-08-18 22:29:12+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtfbciknli2y 2026-08-19 10:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtgizlptq32u 2026-08-19 11:01:27+00:00| seen|...
CVE-2026-70995
creationtimestamp| type| source ---|---|--- 2026-08-18 22:25:09+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtfb3ahozn2u 2026-08-19 08:00:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtgb7bwfn32e 2026-08-19 16:46:01+00:00| seen|...
CVE-2026-73930
creationtimestamp| type| source ---|---|--- 2026-08-18 22:00:49+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtf7pmeark2t 2026-08-18 22:29:21+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtfbcr4kzg2j 2026-08-19 10:20:05+00:00| seen|...
CVE-2026-54543
Froxlor is open source server administration software. Prior to 2.3.8, the DomainZones.add API command in lib/Froxlor/Api/Commands/DomainZones.php accepts user-controlled record and type values without rejecting line delimiters, tab characters, semicolons, or unsupported DNS record types before...
CVE-2026-70765
Oracle Hyperion Financial Reporting Server (version 11.2.25.0.000) is vulnerable to an unauthenticated, low-complexity HTTP attack requiring human interaction. CVSS 3.1 scores it 6.1 (Medium) with scope change, enabling unauthorized read and update/insert/delete access to some product data. Explo...
