91348 matches found
CVE-2026-28188: Missing Authorization
Unauthenticated Broken Access Control in Hydra Booking = 1.2.2 versions...
CVE-2026-16871: Out-of-bounds Write
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a heap buffer overflow...
CVE-2026-58420: Improper Access Control
Local File Inclusion via file:// URI in Migration Restore...
CVE-2026-28161: Incorrect Privilege Assignment
Subscriber Privilege Escalation in Service Finder Booking = 6.2 versions...
CVE-2026-24059: Improper Privilege Management
The GET /api/v1/user/actions/runners/registration-token endpoint and its owner- and repository-level equivalents creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token...
CVE-2026-58511: Exposure of Sensitive Information to an Unauthorized Actor
Webhook Authorization Header Returned in Plaintext via API...
CVE-2026-18086: Out-of-bounds Write
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary code or cause a denial of service due to improper bounds checking...
CVE-2025-62318: Cross-Site Request Forgery (CSRF)
HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages, potentially allowing sensitive information to be captured by an attacker-controlled page JavaScript hijacking under certain conditions...
CVE-2025-62314: Improper Restriction of Excessive Authentication Attempts
HCL AION is affected by a vulnerability where certain endpoints lack sufficient anti-automation controls. Automated or scripted requests may be submitted without adequate rate limiting or challenge mechanisms, potentially resulting in unintended behavior or security impact under certain condition...
CVE-2026-66655: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in MultiParcels Shipping For WooCommerce = 1.30.36 versions...
CVE-2026-13365: Cross-Site Request Forgery (CSRF)
IBM Planning Analytics 2.0, and 2.1 Local is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...
CVE-2026-28142: Improper Neutralization of Special Elements used in an SQL Command
Unauthenticated SQL Injection in Web Directory Free = 1.7.13 versions...
CVE-2026-56860: Inefficient Algorithmic Complexity
Previously, resolving relative paths containing parent directory '..' segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking f...
Linux Distros Unpatched Vulnerability : CVE-2026-73499
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a...
CVE-2026-56862: Allocation of Resources Without Limits or Throttling
Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely...
Linux Distros Unpatched Vulnerability : CVE-2026-14681
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pghba.conf rules, via initial direct TLS...
CVE-2026-56859: Allocation of Resources Without Limits or Throttling
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...
CVE-2026-33818: Uncontrolled Resource Consumption
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...
RHEL 10 : freerdp (RHSA-2026:54667)
The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:54667 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP...