20972 matches found
EUVD-2026-17735
A security vulnerability has been detected in code-projects BloodBank Managing System 1.0. This affects an unknown part of the file /adminstate.php. The manipulation of the argument statename leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been...
CVE-2026-5240
A security vulnerability has been detected in code-projects BloodBank Managing System 1.0. This affects an unknown part of the file /adminstate.php. The manipulation of the argument statename leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been...
OpenClaw has a CWD `.env` environment variable injection which bypasses host-env policy and allows config takeover
Summary OpenClaw loaded the current working directory .env before trusted state-dir configuration, allowing untrusted workspace state to inject host environment values. Impact A repository or workspace containing a malicious .env file could override runtime configuration and security-sensitive...
GHSA-8RH7-6779-CJQQ OpenClaw has a CWD `.env` environment variable injection which bypasses host-env policy and allows config takeover
Summary OpenClaw loaded the current working directory .env before trusted state-dir configuration, allowing untrusted workspace state to inject host environment values. Impact A repository or workspace containing a malicious .env file could override runtime configuration and security-sensitive...
Medium: webkitgtk4
Issue Overview: The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, macOS Sequoia 15.6, iOS 18.6 and iPadOS 18.6, tvOS 18.6, watchOS 11.6, visionOS 2.6. Processing maliciously crafted web content may lead to an unexpected Safari crash. CVE-2025-43213 The iss...
PT-2026-36389
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A state inconsistency occurs in the cdns3 USB driver when cdns3 gadget start fails. In this scenario, the Dual-Role Device DRD hardware remains in gadget mode while the software state is...
PT-2026-33861
Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.28 Description An environment variable injection issue occurs because the software loads the .env file from the current working directory before the trusted state-dir configuration. This allows untrusted...
The vulnerability of the `airoha_tc_get_htb_get_leaf_queue()` function in the `drivers/net/ethernet/airoha/airoha_eth.c` file of the Linux kernel’s Ethernet driver module allows a hacker to induce a service failure.
The vulnerability of the airohatcgethtbgetleafqueue function in the drivers/net/ethernet/airoha/airohaeth.c file of the Linux kernel’s Ethernet driver module is related to state management errors. Exploiting this vulnerability could allow an attacker to cause a system failure...
The software for designing and configuring electrical systems of Schneider Electric EcoStruxure Power Build Rapsody is vulnerable due to the use of memory after it is released. This vulnerability allows a attacker to execute arbitrary code.
The vulnerability of Schneider Electric EcoStruxure Power Build Rapsody software for designing and configuring electrical systems is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to execute arbitrary code using a specially created SSD file...
The software for designing and configuring electrical systems of Schneider Electric EcoStruxure Power Build Rapsody is vulnerable due to a memory reclamation error, allowing an attacker to execute arbitrary code.
The vulnerability of Schneider Electric EcoStruxure Power Build Rapsody software for electrical system design and configuration is related to a memory release error. Exploiting this vulnerability could allow an attacker to execute arbitrary code using a specially created SSD file...
The vulnerability of the intel_get_crtc_new_encoder() function in the drivers/gpu/drm/i915/display/intel_display.c driver for the Direct Rendering Infrastructure (DRI) component of the Linux operating system allows a malicious actor to cause a service failure.
The vulnerability of the intelgetcrtcnewencoder function in the drivers/gpu/drm/i915/display/inteldisplay.c file of the Direct Rendering Infrastructure DRI driver for the Linux kernel is related to state management errors. Exploiting this vulnerability could allow an attacker to cause a system...
ROS-20260401-73-0035
A vulnerability in the Node.js software platform is related to an exceptional state handling bug. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...
ROS-20260401-73-0036
A vulnerability in the Node.js software platform is related to an exceptional state handling bug. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...
PT-2026-32351
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Reliable Delivery Service RDS implementation for InfiniBand IB. The function rds ib get mr allows FRMR memory registration to proceed before an IB connection is full...
The vulnerability of the SAVE_ABI_STATE() function in the arch/riscv/kernel/mcount.S module of the Linux operating system’s RISCV architecture-based kernel subsystem allows a attacker to trigger a service failure.
The vulnerability of the SAVEABISTATE function in the arch/riscv/kernel/mcount.S module of the Linux operating system’s RISCV-architecture-based module management subsystem is related to buffer overflow based on a stack. Exploiting this vulnerability could allow an attacker to trigger a service...
Code-Projects BloodBank Managing System 代码注入漏洞
The Code-Projects BloodBank Managing System is an open-source blood bank management system developed by Code-Projects. Version 1.0 of the code-projects BloodBank Managing System contains a code injection vulnerability. This vulnerability stems from incorrect handling of the parameter statename in...
PT-2026-29658
Description The oauth2.php file in OpenSTAManager is an unauthenticated endpoint $skip permissions = true. It loads a record from the zz oauth2 table using the attacker-controlled GET parameter state, and during the OAuth2 configuration flow calls unserialize on the access token field without any...
SUSE SLES15 Security Update : webkit2gtk3 (SUSE-SU-2026:1150-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1150-1 advisory. Update to version 2.52.0: - CVE-2023-43010: processing maliciously crafted web content may lead to memory corruption bsc1259950. -...
