264147 matches found
PT-2026-52443
Malicious HTML content could be injected into the content rendered by the pretix-digital plugin...
PT-2026-52419
Missing Authorization vulnerability in Royal Plugins Royal MCP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Royal MCP: from n/a through 1.4.25...
CVE-2025-60465
A use-after-free in the gffilterpidinstswap function /filtercore/filterpid.c of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service DoS via supplying a crafted media file...
ROS-20260625-73-0015
The vulnerability of the comparestrings function in the GnuTLS library is related to shortcomings in the mechanism for handling register-dependent data. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...
PT-2026-52490
LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the fix for CVE-2024-11171 commit bb58a2d0 added limits: fileSize to createMulterInstance in the file upload routes. However, the POST /api/convos/import endpoint uses a separate multer instance that w...
Oracle WebCenter Sites permission and access control issue vulnerabilities
Oracle WebCenter Sites is a content management system component within Oracle Fusion Middleware, primarily used for website content management and publishing. There is a security vulnerability in Oracle WebCenter Sites. This vulnerability stems from improper handling of user permission...
PT-2026-52621
Name of the Vulnerable Software and Affected Versions vtk vtk-dicom affected versions not specified Description A heap-based buffer overflow occurs in the vtkDICOMItem::NewDataElement function. A heap-based buffer overflow is a memory corruption issue that happens when a program writes more data ...
LangChain < 1.3.9 Path Traversal (CVE-2026-55443)
The version of LangChain installed on the remote host is prior to 1.3.9. It is, therefore, affected by a path traversal vulnerability: - Several LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root director...
VulnCheck KEV: CVE-2024-41700
Barix – CWE-200 Exposure of Sensitive Information to an Unauthorized Actor...
RHEL 9 : libxslt (RHSA-2026:29814)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:29814 advisory. libxslt is a library for transforming XML files into other textual formats including HTML, plain text, and other XML representations of the underlyi...
RockyLinux 9 : libfastjson (RLSA-2023:6431)
The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2023:6431 advisory. json-c, libfastjson: integer overflow and out-of-bounds write via a large JSON file CVE-2020-12762 Tenable has extracted the preceding description block directly...
Oracle WebCenter Portal (June 2026 CSPU)
The 12.2.1.4.0 and 14.1.2.0.0 versions of WebCenter Portal installed on the remote host are affected by multiple vulnerabilities as referenced in the June 2026 CSPU advisory. - Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware component: Security Framework. Supporte...
CVE-2026-40079
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Command Injection due to lack of sanitization in the escapecommand function. The escapecommand function at lib/rrd.php is a no-op: it returns $command unchanged. The command line built ...
CVE-2026-39955
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have pre-authentication SQL Injection via unanchored FILTERVALIDATEREGEXP in graphview.php. This issue has been fixed in version 1.2.31...
EUVD-2026-39134
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Path Traversal via filename parameter in packageimport.php. This issue has been fixed in version 1.2.31...
CVE-2026-33543
creationtimestamp| type| source ---|---|--- 2026-06-24 22:25:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2xgkyhne2g...
CVE-2026-54070
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, renderPackageREADME in kernel/bazaar/readme.go renders a Bazaar package README from Markdown to HTML with the lute engine and SetSanitizetrue. The lute sanitizer is an event-handler blocklist: allowAttr rejects only...
Use of a Key Past its Expiration Date
Overview Affected versions of this package are vulnerable to Use of a Key Past its Expiration Date due to the password-reset token generation process. An attacker can gain unauthorized access to user accounts by exploiting the extended validity period of reset tokens, even when a shorter expirati...