93 matches found
CVE-2026-83595 AVideo Cross-Site Request Forgery via plugin/API/set.json.php
AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php that allows attackers to perform state-changing actions by crafting GET requests that bypass CSRF protection. Attackers can navigate a victim's browser to a malicious URL with API parameters to delete videos,...
CVE-2026-50015
A flaw was found in pnpm. An attacker can exploit this by contributing a malicious patch file through a pull request. During the pnpm install process, the patch application pipeline fails to validate file paths extracted from these patch files. This allows the attacker to write or delete arbitrar...
CVE-2026-48547
KanaDojo contains a command injection vulnerability that allows an attacker with pull request access to execute arbitrary shell commands by inserting shell metacharacters into the version or changes fields of patchNotesData.json, which are interpolated unsanitized into a childprocess.execSync cal...
CVE-2026-42298 Postiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev
Postiz is an AI social media scheduling tool. Prior to commit da44801, a "Pwn Request" vulnerability in the Build and Publish PR Docker Image workflow .github/workflows/pr-docker-build.yml allows any unauthenticated user to execute arbitrary code during the Docker build process and exfiltrate a...
PT-2026-37357
Before sq-git checks if a commit can be authenticated, it first looks for hard revocations. Because parsing a policy is expensive and a project's policy rarely changes, sq-git has an optimization to only check a policy if it hasn't checked it before. It does this by maintaining a set of policies...
HP Color LaserJet Path Traversal (CVE-2006-1654)
Directory traversal vulnerability in the HP Color LaserJet 2500 Toolbox and Color LaserJet 4600 Toolbox on Microsoft Windows before 20060402 allows remote attackers to read arbitrary files via a .. dot dot in an HTTP GET request to TCP port 5225. This plugin only works with Tenable.ot. Please vis...
EUVD-2026-12407
Mattermost versions 11.3.x = 11.3.0, 11.2.x = 11.2.2, 10.11.x = 10.11.10 fail to sanitize client-supplied post metadata which allows an authenticated attacker to spoof permalink embeds impersonating other users via crafted PUT requests to the post update API endpoint.. Mattermost Advisory ID:...
The vulnerability of the fromDhcpListClient() function in the Tenda F453 router software allows a hacker to execute arbitrary code.
The vulnerability of the fromDhcpListClient function in the Tenda F453 router’s microprogramming software is related to the copying of buffers without checking the size of the input data when processing the page parameter. Exploiting this vulnerability allows an attacker to execute arbitrary code...
The vulnerability of the strcpy() function in the microprogrammed software for UTT 520W routers allows a hacker to cause a service failure.
The vulnerability of the strcpy function in the UTT 520W router microprogramming system is related to the output of the operation being sent out of the buffer into memory. Exploiting this vulnerability could allow a malicious actor to cause a service failure by sending a specially crafted POST...
MiracleLinux 7 : 389-ds-base-1.3.11.1-5.el7 (AXSA:2024-8119:05)
The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-8119:05 advisory. 389-ds-base: potential denial of service via specially crafted kerberos AS-REQ request CVE-2024-3657 389-ds-base: Malformed userPassword may cause...
CVE-2025-67173
A Cross-Site Request Forgery CSRF in the page creation/editing function of RiteCMS v3.1.0 allows attackers to arbitrarily create pages via a crafted POST request...
CVE-2025-57212
Incorrect access control in the component ApiOrderService.java of platform v1.0.0 allows attackers to access sensitive information via a crafted request...
EUVD-2020-24500
Malware in sbrugna...
EUVD-2016-2400
Malware in sbrugna...
EUVD-2020-18300
Malware in sbrugna...
EUVD-2019-16088
Malware in sbrugna...
EUVD-2018-10951
Malware in sbrugna...
EUVD-2017-3383
Malware in sbrugna...