Eclipse Glassfish 安全漏洞

Eclipse Glassfish is an application server developed by the Eclipse Foundation. Eclipse Glassfish has a security vulnerability, which stems from improper handling of expressions in the server-side template rendering mechanism. This vulnerability allows remote attackers to completely destroy the...

CVE-2021-47952

A flaw was found in python-jsonpickle. A remote attacker can exploit this vulnerability by crafting and sending malicious JSON payloads. When these payloads, which contain specially crafted py/repr objects, are deserialized, they can trigger the execution of arbitrary Python commands and system...

PrestaShop UPS Shipping 信息泄露漏洞

PrestaShop UPS Shipping is an e-commerce logistics delivery module provided by the French company PrestaShop. There is a vulnerability in PrestaShop UPS Shipping, which stems from issues with the components /upsshipping/logs/ and components/upsshipping/lib/UPSBaseApi.php. This vulnerability may...

The vulnerability of the NPM packet manager’s vm2 library allows attackers to bypass the sandbox’s security mechanisms.

The vulnerability of the NPM package manager’s vm2 library is related to uncontrolled changes to object prototype attributes. Exploiting this vulnerability could allow a remote attacker to bypass the sandbox’s security mechanisms...

Vulnerabilities found in Cisco Catalyst SD-WAN Controllers and Managers

Cisco has identified vulnerabilities in the Catalyst SD-WAN Controller and Manager products. Cisco has uncovered four vulnerabilities in these products. These vulnerabilities involve XXE injection, privilege escalation, and authentication bypass. The authentication bypass vulnerability resides in...

MLflow 安全漏洞

MLflow is an open-source platform that simplifies machine learning development. It includes features like tracking experiments, packaging code for reproducible runs, and sharing and deploying models. Versions of mlflow prior to 3.9.0 contain security vulnerabilities. These vulnerabilities stem fr...

PT-2026-41710

Name of the Vulnerable Software and Affected Versions Microsoft Edge Chromium-based affected versions not specified Description Improper input validation in Microsoft Edge Chromium-based allows an unauthorized attacker to bypass a security feature over a network. This issue is related to an origi...

ROS-20260515-73-0033

A vulnerability in the Web Speech component of Google Chrome and Microsoft Edge browser is related to reading beyond buffer boundaries. Exploitation of the vulnerability could allow a remote attacker to affect the confidentiality, integrity and availability of protected information using a...

The vulnerability of Microsoft Bing’s search system, related to deficiencies in the deserialization mechanism, allows a perpetrator to execute arbitrary code.

The vulnerability of Microsoft Bing’s search system is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20260515-73-0054

A vulnerability in the DevTools component of the Google Chrome browser is related to access control flaws. Exploitation of the vulnerability could allow an attacker acting remotely to bypass security restrictions using a specially crafted HTML page...

Flowsint 跨站脚本漏洞

Flowsint is an open-source intelligence visualization tool developed by reconurge. Versions of Flowsint prior to 1.2.3 contained a cross-site scripting vulnerability. This vulnerability stemmed from node descriptions containing arbitrary HTML, allowing remote attackers to create nodes with...

Cisco Catalyst SD-WAN Manager 输入验证错误漏洞

Cisco Catalyst SD-WAN Manager is a highly customizable dashboard provided by the American company Cisco. It simplifies and automates the deployment, configuration, management, and operation of Cisco SD-WAN. There is an input validation vulnerability in Cisco Catalyst SD-WAN Manager, which stems...

CVE-2026-31216

The nexent v1.7.5.2 backend service contains an unauthorized arbitrary storage file deletion vulnerability in its file management API. The DELETE /storage/objectname:path endpoint lacks authentication, authorization, and input validation mechanisms. Unauthenticated remote attackers can send craft...

CVE-2026-44125

SEPPmail Secure Email Gateway before version 15.0.4 fails to enforce authorization checks for multiple endpoints in the new GINA UI, allowing unauthenticated remote attackers to access functionality that should require a valid session...

The vulnerability of the data protection software through backup using PowerProtect Data Domain for Dell EMC Data Domain Operating Systems allows a hacker to execute arbitrary commands with root privileges.

The vulnerability of the data protection software through PowerProtect Data Domain’s backup solution for Dell EMC Data Domain Operating Systems is related to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability could allow an attacker to execute arbitrary...

The vulnerability of the parse_uname_string() function on the security monitoring and threat detection platform Wazuh allows a malicious actor to cause system failures.

The vulnerability of the parseunamestring function on the security monitoring and threat detection platform Wazuh is related to a numerical loss of significance. Exploiting this vulnerability could allow an attacker operating remotely to cause malfunctions in the platform’s operation...

The vulnerability of the JAXP component of the Oracle Java SE software platform, as well as of the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines, allows attackers to gain unauthorized access to devices.

The vulnerability of the JAXP component of the Oracle Java SE software platform, as well as of the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines, is related to the lack of protection for application data. Exploiting this vulnerability can allow an attacker, operati...

ROS-20260513-73-0004

Vulnerability in rubygem-rack related to permissive regular expressions. Exploitation of the vulnerability may allow a remote attacker to gain unauthorized access to protected information...

The vulnerability of the Telnet Client command-line tool for Windows operating systems allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Telnet Client command-line tool for Windows operating systems relates to the execution of operations beyond the buffer in memory. Exploiting this vulnerability can allow an attacker, working remotely, to gain unauthorized access to protected information...

The vulnerability of the Mattermost instant messaging application, related to information disclosure, allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the Mattermost instant messaging application is related to the disclosure of information. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...