CVE-2026-21280

Illustrator versions 29.8.3, 30.0 and earlier are affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. If the application uses a search path to locate critical resources such as programs, an attacker could modify that...

CVE-2026-23492

Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, an incomplete SQL injection patch in the Admin Search Find API allows an authenticated attacker to perform blind SQL injection. Although CVE-2023-30848 attempted to mitigate SQL injection by removing SQL...

CVE-2026-20943

Untrusted search path in Microsoft Office allows an unauthorized attacker to execute code locally...

CVE-2026-23492 Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848

Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, an incomplete SQL injection patch in the Admin Search Find API allows an authenticated attacker to perform blind SQL injection. Although CVE-2023-30848 attempted to mitigate SQL injection by removing SQL...

CVE-2026-23492 Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848

Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, an incomplete SQL injection patch in the Admin Search Find API allows an authenticated attacker to perform blind SQL injection. Although CVE-2023-30848 attempted to mitigate SQL injection by removing SQL...

CVE-2026-23492

Pimcore Admin Search Find API exposes blind SQL injection due to an incomplete patch from CVE-2023-30848. Affected versions: Pimcore before 12.3.1 and before 11.5.14. Attack requires authenticated access to the admin interface and can disclose database information via blind SQL injection, potenti...

Hackers Exploit c-ares DLL Side-Loading to Bypass Security and Deploy Malware

Security experts have disclosed details of an active malware campaign that's exploiting a DLL side-loading vulnerability in a legitimate binary associated with the open-source c-ares library to bypass security controls and deliver a wide range of commodity trojans and stealers. "Attackers achieve...

CVE-2026-0694

The SearchWiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in search results in all versions up to, and including, 1.0.0. This is due to the plugin using escattr instead of eschtml when outputting post titles in search results. This makes it possible for...

CVE-2026-0694 SearchWiz <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title

The SearchWiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in search results in all versions up to, and including, 1.0.0. This is due to the plugin using escattr instead of eschtml when outputting post titles in search results. This makes it possible for...

CVE-2026-0694

The CVE-2026-0694 entry concerns the WordPress SearchWiz plugin. A Stored Cross-Site Scripting (XSS) vulnerability exists in all versions up to 1.0.0 due to the plugin outputting post titles in search results with esc_attr() instead of esc_html(). This enables authenticated attackers, at contribu...

CVE-2026-0694 SearchWiz <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title

The SearchWiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in search results in all versions up to, and including, 1.0.0. This is due to the plugin using escattr instead of eschtml when outputting post titles in search results. This makes it possible for...

CVE-2025-66176

There is a Stack overflow Vulnerability in the device Search and Discovery feature of Hikvision Access Control Products. If exploited, an attacker on the same local area network LAN could cause the device to malfunction by sending specially crafted packets to an unpatched device...

CVE-2025-66177

There is a Stack overflow Vulnerability in the device Search and Discovery feature of Hikvision NVR/DVR/CVR/IPC models. If exploited, an attacker on the same local area network LAN could cause the device to malfunction by sending specially crafted packets to an unpatched device...

Pimcore SQL注入漏洞

Pimcore is Austria Pimcore company's set of open source for creating and managing Web applications Web content management platform. The platform integrates Web content management, e-commerce framework and product information management applications. A SQL injection vulnerability exists in Pimcore...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001193)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001193 advisory. The keyringsearchaux function in security/keys/keyring.c in the Linux kernel through 3.14.79 allows local users to cause a denial of service NULL pointer dereference...

Complete Online Beauty Parlor Management System /search-invoices.php File Cross-Site Scripting Vulnerability

Complete Online Beauty Parlor Management System is an online beauty parlor management system. Complete Online Beauty Parlor Management System suffers from a cross-site scripting vulnerability that stems from an incorrect manipulation of the parameter searchdata in the file...

The vulnerability of the Remote Connection tool for applications and Parallels Client, related to an uncontrolled search path element, allows a perpetrator to escalate their privileges.

The vulnerability of the remote connection tool for applications and the Parallels Client is related to an uncontrolled element in the search process. Exploiting this vulnerability can allow attackers to increase their privileges...

The vulnerability of the search and detection function for micro-programmed wireless access points from Hikvision allows a intruder to trigger a service failure.

The vulnerability of the search and detection function for Hikvision wireless access points is related to buffer overflow in the stack. Exploiting this vulnerability could allow a malicious actor to cause service interruptions by sending specially crafted packets...

PT-2026-2956

Name of the Vulnerable Software and Affected Versions SumatraPDF versions 3.5.2 and earlier Description SumatraPDF is a multi-format reader for Windows. A flaw exists due to an Untrusted Search Path when the Advanced Options setting is triggered. The application executes notepad.exe without...

PT-2026-6367

Impact Versions of the Algolia Search & Discovery extension for Magento 2 prior to 3.17.2 and 3.16.2 contain a vulnerability where data read from the database was treated as a trusted source during job execution. If an attacker is able to modify records used by the extension’s indexing queue, thi...