161119 matches found
VulnCheck KEV: CVE-2026-93952
Arista VeloCloud Orchestrator VCO on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the...
Arista VeloCloud Orchestrator Improper Input Validation Vulnerability
Arista VeloCloud Orchestrator VCO on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the...
CVE-2026-18134: Cleartext Transmission of Sensitive Information
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to cleartext transmission of sensitive information...
PT-2026-97112
Name of the Vulnerable Software and Affected Versions OpenEye Apex Network Video Recorder versions 2.2.3.4 through 3.2.9.376 Description The software trusts an X-Forwarded-For header provided by a client to determine the request source address. This allows an unauthenticated remote attacker to...
CVE-2026-18172: Improper Restriction of XML External Entity Reference
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper restriction of XML external entity references...
ROS-20260922-73-0063
The vulnerability in Tomcat11 is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow attackers, who operate remotely, to gain increased privileges...
ROS-20260922-73-0052
The vulnerability of the iscsithandletextcmd function in the drivers/target/iscsi/iscsitarget.c module of the Linux operating system’s TCM driver is related to the execution of operations outside of the buffer. Exploiting this vulnerability could allow a remote attacker to compromise the...
Unity Linux 20.1070e Security Update: libxslt (UTSA-2022-001980)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2022-001980 advisory. Use after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Tenabl...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libwebp (UTSA-2023-002880)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002880 advisory. Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a...
ROS-20260922-73-0124
The vulnerability in golang-x-crypto is related to incorrect type conversion. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...
PT-2026-96857
A vulnerability was found in dgtlmoon changedetection.io up to 50389b07. This vulnerability affects the function add watch ui snapshot of the file changedetectionio/blueprint/add watch ui/ init .py of the component Preview Endpoint. Performing a manipulation of the argument url results in...
CVE-2026-76712: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability exists in the Analytics and Location Engine ALE that may allow for unauthorized access, information disclosure, or denial of service. An unauthenticated remote attacker could exploit the vulnerable system by sending specially crafted input or intercepting network communications...
CVE-2026-76716: Allocation of Resources Without Limits or Throttling
Multiple vulnerabilities exist in the Analytics and Location Engine ALE that may allow for unauthorized access or denial of service. An unauthenticated remote attacker could exploit these vulnerabilities by sending specially crafted input or leveraging improper security configurations. Successful...
PT-2026-97021
Name of the Vulnerable Software and Affected Versions yaml-cpp version 0.9.0 Description A remote attacker can obtain sensitive information through the src/scanner.cpp file, specifically within the Scanner::PopIndent and Scanner::PushIndentTo functions. Recommendations At the moment, there is no...
CVE-2026-95820: Unrestricted Upload of File with Dangerous Type
A vulnerability was found in anirbandutta9 College-Notes-Gallery up to 8c1cf3d98f30982d069c88ca172612c001eb39f6. Affected by this issue is some unknown functionality of the file /dashboard/userprofile.php?section=admin1. Performing a manipulation of the argument image results in unrestricted...
CVE-2026-18176: Cleartext Transmission of Sensitive Information
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to cleartext transmission of sensitive information...
CVE-2026-95501: Improper Control of Generation of Code
A vulnerability was found in mtrano APENCMS up to 6546096d354153309693efabb9a0d824628ed4f5. The affected element is the function eval of the file cms/weasel.php of the component Template Engine. The manipulation of the argument $CMS'site' results in code injection. The attack may be performed fro...
CVE-2026-18173: Improper Certificate Validation
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper enforcement of mutual TLS authentication...
CVE-2026-43643: Missing Authorization
Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains an authorization bypass vulnerability in the billing module handler that allows unauthenticated remote attackers to modify any tenant's account balance by supplying crafted act and frombillingmodule parameters to the admin panel...
CVE-2026-95660: Improper Neutralization of Special Elements used in an OS Command
A security flaw has been discovered in Moonshot AI Kimi Code up to 0.31.0. The affected element is an unknown function of the file agent-core-v2/src/agent/mcp/config-loader.ts of the component MCP Configuration Loader. The manipulation results in os command injection. The attack may be launched...