1410746 matches found
CVE-2026-67355
guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as host-only. Attackers controlling child hosts can receive host-only cookies intended only for parent hosts, potentially disclosing session...
CVE-2026-67320
CVE-2026-67320 affects axios on Node.js when using the HTTP adapter. A hardened config object can be re-exposed to regular objects via common patterns, allowing an attacker to pollute Object.prototype.proxy and route plaintext-HTTP requests through a malicious proxy. Impact includes exposure of A...
EUVD-2026-51864
axios versions =1.15.2 and 1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling lib/adapters/http.js and lib/helpers/resolveConfig.js. When an application is already affected by a separate prototype-pollution primitive and makes an axios request with an own auth...
CVE-2026-67293
FreeRDP before 3.29.0 affected versions = 3.28.0 contains an improper certificate hostname validation vulnerability. The TLS hostname matcher tlsmatchhostname in libfreerdp/crypto/tls.c treats a wildcard pattern such as .example.com as matching any hostname ending in .example.com, so it incorrect...
CVE-2026-2411
Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characteristic Declaration whose permission is hard-coded to BTGATTPERMREAD, and a Characteristic Value attribute that carries the application-specified security permissions e.g. BTGATTPERMREADENCRYPT /...
CVE-2026-2411
CVE-2026-2411 affects Zephyr’s Bluetooth host GATT: when a Characteristic Declaration is used with a value that requires encryption/authentication, the permission check erroneously evaluated the declaration instead of the value, allowing the Notification/Indicate path to bypass encryption require...
CVE-2026-2411 Bluetooth GATT notify/indicate enforces the wrong attribute's permissions, bypassing encryption/authentication requirements on characteristic values
Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characteristic Declaration whose permission is hard-coded to BTGATTPERMREAD, and a Characteristic Value attribute that carries the application-specified security permissions e.g. BTGATTPERMREADENCRYPT /...
CVE-2026-18344
creationtimestamp| type| source ---|---|--- 2026-08-01 10:14:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/hcboak6644dts 2026-08-01 17:43:21+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrzzfowyul2l 2026-08-01 17:44:05+00:00| seen|...
RHSA-2026:49033 Red Hat Security Advisory: kernel security update
Bulletin has no description...
RHSA-2026:49030 Red Hat Security Advisory: kernel security update
Bulletin has no description...
RHSA-2026:48790 Red Hat Security Advisory: osbuild-composer security update
Bulletin has no description...
RHSA-2026:48585 Red Hat Security Advisory: fence-agents security update
Bulletin has no description...
RHSA-2026:43225 Red Hat Security Advisory: OpenShift Container Platform 4.15.67 packages and security update
Bulletin has no description...
RHSA-2026:42125 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Bulletin has no description...
LoLLMS WebUI < 9.8 - Path Traversal
parisneo/lollms-webui contains a path traversal caused by improper handling of 'category' parameter in /listpersonalities endpoint, letting attackers list arbitrary directories, exploit requires control over 'category' parameter. id: CVE-2024-4322 info: name: LoLLMS WebUI 9.8 - Path Traversal...
Magento Server Mass Importer - Cross-Site Scripting
Magento Server Mass Importer plugin contains multiple cross-site scripting vulnerabilities which allow remote attackers to inject arbitrary web script or HTML via the 1 profile parameter to web/magmi.php or 2 QUERYSTRING to web/magmiimportrun.php. id: CVE-2015-2068 info: name: Magento Server Mass...
Mitel MiCollab - Arbitary File Read
The Mitel Collab Arbitrary File Read vulnerability allows an unauthenticated attacker to read arbitrary files from the underlying file system on a Mitel Collab server. Exploiting this flaw involves sending specially crafted requests to the server, bypassing access controls and allowing the attack...
Jira Improper Authorization
The /rest/issueNav/1/issueTable resource in Jira before version 8.3.2 allows remote attackers to enumerate usernames via an incorrect authorisation check. id: CVE-2019-8446 info: name: Jira Improper Authorization author: dhiyaneshDk severity: medium description: The /rest/issueNav/1/issueTable...
Ruby On Rails - Local File Inclusion
Ruby On Rails is vulnerable to local file inclusion caused by secondary decoding in Sprockets 3.7.1 and lower versions. An attacker can use %252e%252e/ to access the root directory and read or execute any file on the target server. id: CVE-2018-3760 info: name: Ruby On Rails - Local File Inclusio...
WordPress WP Security Audit Log 3.1.1 - Information Disclosure
WordPress WP Security Audit Log 3.1.1 plugin is susceptible to information disclosure. Access to wp-content/uploads/wp-security-audit-log/ files is not restricted. An attacker can obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2018-8719 info: name:...