18384 matches found
CVE-2026-63222 CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames
CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the...
SUSE CVE-2026-14266
7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page...
EUVD-2026-51331
An incomplete fix for CVE-2026-15352 in the NASA core Flight System cFS Health and Safety HS application leaves a separate NULL pointer dereference reachable in versions through 7.0.1. An attacker who can trigger the affected command under specific conditions could cause the HS application to...
Oracle Linux 7 : gimp (ELSA-2026-26168)
The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-26168 advisory. - Fixes CVE-2026-4150, CVE-2026-4153, CVE-2026-4154, and CVE-2026-4887 Orabug: 39564202 - Fixes CVE-2025-14422 Orabug: 38904303 - Fixes CVE-2025-10922...
Atlassian Confluence 9.0.1 / 9.1.x / 9.2.x < 9.2.17 / 9.3.1 / 9.4.x / 9.5.1 / 10.0.2 / 10.1.x / 10.2.x < 10.2.7 (CONFSERVER-104334)
The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104334 advisory. - This High severity DoS Denial of Service vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and...
PT-2026-66836
Name of the Vulnerable Software and Affected Versions Thumbor versions prior to 7.8.0 Description The ALLOWED SOURCES configuration, designed to restrict the hosts from which the HTTP loader fetches images, fails to escape dots when processing plain-string entries. These strings are passed direct...
PT-2026-66841
Name of the Vulnerable Software and Affected Versions Thumbor versions prior to 7.8.0 Description The convolution filter regular expression performs exponential backtracking when processing crafted repeated numeric input. This leads to a Regular Expression Denial of Service ReDoS, where a special...
CVE-2026-18064
CVE-2026-18064 affects NASA’s core Flight System (cFS) Health and Safety (HS) application. The issue is an incomplete fix for CVE-2026-15352, leaving a separate NULL pointer dereference exploitable in HS versions up to and including 7.0.1. A successful trigger of the affected command under specif...
CVE-2026-18064 NASA Core Flight System (cFS) Health & Safety (HS) Application NULL Pointer Dereference
An incomplete fix for CVE-2026-15352 in the NASA core Flight System cFS Health and Safety HS application leaves a separate NULL pointer dereference reachable in versions through 7.0.1. An attacker who can trigger the affected command under specific conditions could cause the HS application to...
EUVD-2024-55705
IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.2.1 through 9.7.2.11, and 9.6.1.1 through 9.6.1.13 do not limit the length of a connection which could allow for a Slowloris HTTP denial of service attack to take place. This can cause the web server to become unresponsive...
CVE-2024-25039 IBM Engineering Requirements Management DOORS and DOORS Web Access is affected by multiple vulnerabilities
IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.2.1 through 9.7.2.11, and 9.6.1.1 through 9.6.1.13 do not limit the length of a connection which could allow for a Slowloris HTTP denial of service attack to take place. This can cause the web server to become unresponsive...
SUSE CVE-2026-54158
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the attribute-view database cell renderer genAVValueHTML interpolates cell content raw in four of its branches: text, url, phone, and mAsset. A cell value like or " breaks out of its surrounding tag and runs arbitrary...
JLSEC-2026-1032 ImageMagick: Memory Leak in wand option parser when providing invalid arguments
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-25, when providing invalid options to the wand option parser a small memory leak will occur. This issue has been patched in version 7.1.2-25...
CVE-2026-14522
IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to execute arbitrary commands due to improper neutralization of CRLF characters...
OPENSUSE-SU-2026:21487-1 Security update for tomcat10
This update for tomcat10 fixes the following issues: Update to Tomcat 10.1.57. Security issues fixed: - CVE-2026-59083: incorrect URL decoding in RewriteValve may allow security control bypass bsc1271397. - CVE-2026-59084: EncryptInterceptor requirements are not clearly documented bsc1271398. Oth...
CVE-2026-14266
A flaw was found in 7-Zip. This vulnerability allows a remote attacker to execute arbitrary code on affected installations. Exploitation requires user interaction, such as opening a specially crafted malicious file or visiting a malicious web page. The flaw occurs during the processing of...
CLEANSTART-2026-GX16359 Security fixes in confluent-common-docker 7.6.9-r3
Package confluent-common-docker version 7.6.9-r3 fixes 4 vulnerabilities: CVE-2025-11226, CVE-2026-1225, ghsa-25qh-j22f-pwp8, ghsa-qqpg-mvqg-649v...
CLEANSTART-2026-IS96483 Security fixes in apache-hive 4.0.0-r1
Package apache-hive version 4.0.0-r1 fixes 27 vulnerabilities: CVE-2024-47561, CVE-2024-7254, CVE-2024-47554, CVE-2022-41881, CVE-2023-34462...
CLEANSTART-2026-KI12594 Security fixes in cluster-proportional-autoscaler 1.7.1-r0
Package cluster-proportional-autoscaler version 1.7.1-r0 fixes 7 vulnerabilities: CVE-2021-3121, CVE-2022-3064, CVE-2020-8559, CVE-2019-11254, CVE-2019-11250...