159511 matches found
ROS-20261002-73-0116
The vulnerability of the PostgreSQL database management system is related to incorrect session duration. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to read and modify data...
Siemens SIMATIC S7-1500 CPU 1518 MFP Improper Input Validation (CVE-2026-46037)
This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505962; scriptversion"1.2"; scriptsetattributeattribute:"pluginmodificationdate",...
PT-2026-104194
A security flaw has been discovered in itsourcecode Online Admission System Project 1.0. The impacted element is an unknown function of the file confirm.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the...
PT-2026-104346
A security flaw has been discovered in CodeAstro Simple Loan Management System 1.0. Impacted is an unknown function of the file /admin/index.php. Performing a manipulation of the argument g name results in sql injection. The attack may be initiated remotely. The exploit has been released to the...
The vulnerability of the HMACAlgorithm.from_jwk method in the PyJWT library allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the HMACAlgorithm.fromjwk method in PyJWT is related to errors in verifying the cryptographic signature. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...
The vulnerability of the ColdFusion software platform, related to the failure to eliminate instructions in dynamically executed code, allows attackers to execute arbitrary code.
The vulnerability of the ColdFusion software platform lies in the lack of measures taken to neutralize instructions in dynamically executed code. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
The vulnerability of the PyJWT OKPAlgorithm.from_jwk() function in the jwt/algorithms.py scenario from the PyJWT library allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the PyJWT OKPAlgorithm.fromjwk function in the jwt/algorithms.py library is related to the use of an unreliable source. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...
The vulnerability of the normalizePath() function in the src/WhitespacePathNormalizer.php file of the Flysystem library, which allows a attacker to compromise the integrity of the protected information.
The vulnerability of the normalizePath function in the src/WhitespacePathNormalizer.php file of the Flysystem library is related to the failure to take measures to eliminate special elements. Exploiting this vulnerability could allow a remote attacker to compromise the integrity of the protected...
CVE-2026-103627: Exposure of Sensitive Information to an Unauthorized Actor
Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...
mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...
CVE-2026-104020 Uncontrolled recursion in the Ion reader in Amazon Ion Python
Uncontrolled recursion in the Ion reader in Amazon Ion Python before 0.15.0 might allow a remote unauthenticated actor to crash the application using the library, resulting in a denial of service, via a crafted, deeply nested Ion value. To remediate this issue, users should upgrade to version...
EUVD-2026-91008
Confluent Kafka Python client's HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive information due to improper TLS certificate validation...
CVE-2026-102825
A flaw was found in russh. The server fails to enforce the configured limit on maximum authentication attempts during user authentication. An unauthenticated remote attacker can exploit this flaw by continuously submitting authentication requests over a single connection. This allows an attacker ...
russh: russh: Authentication attempt limit bypass via unenforced maximum authentication attempts
A flaw was found in russh. The server fails to enforce the configured limit on maximum authentication attempts during user authentication. An unauthenticated remote attacker can exploit this flaw by continuously submitting authentication requests over a single connection. This allows an attacker ...
PYSEC-2026-4076 BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens
A vulnerability was identified in BerriAI litellm up to 1.82.2. This impacts the function getredirectresponsefromopenid of the file litellm/proxy/managementendpoints/uisso.py of the component SSO Authentication Flow. The manipulation leads to session expiration. The attack is possible to be carri...
BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader
A weakness has been identified in BerriAI litellm up to 1.82.2. Affected by this vulnerability is the function loadopenapispecasync of the file litellm/proxy/experimental/mcpserver/openapitomcpgenerator.py of the component MCP OpenAPI Spec Loader. This manipulation of the argument specpath causes...
PYSEC-2026-4072 BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure
A security vulnerability has been detected in BerriAI litellm up to 1.82.2. Affected by this issue is the function uiviewusers of the file litellm/proxy/managementendpoints/internaluserendpoints.py of the component Incomplete Fix CVE-2025-0628. Such manipulation leads to improper authorization. I...
PYSEC-2026-4069 BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader
A weakness has been identified in BerriAI litellm up to 1.82.2. Affected by this vulnerability is the function loadopenapispecasync of the file litellm/proxy/experimental/mcpserver/openapitomcpgenerator.py of the component MCP OpenAPI Spec Loader. This manipulation of the argument specpath causes...
BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure
A security vulnerability has been detected in BerriAI litellm up to 1.82.2. Affected by this issue is the function uiviewusers of the file litellm/proxy/managementendpoints/internaluserendpoints.py of the component Incomplete Fix CVE-2025-0628. Such manipulation leads to improper authorization. I...
LiteLLM: MCP Proxy Has Improper Authentication
A weakness has been identified in BerriAI litellm up to 1.59.8. Affected is the function UserAPIKeyAuth of the file litellm/proxy/experimental/mcpserver/auth/userapikeyauthmcp.py of the component MCP Proxy. Executing a manipulation can lead to improper authentication. The attack may be launched...