34887 matches found
PT-2026-4348
Name of the Vulnerable Software and Affected Versions Dell ECS versions 3.8.1.0 through 3.8.1.7 Dell ObjectScale versions prior to 4.2.0.0 Description Dell ECS and Dell ObjectScale contain a flaw that allows cleartext storage of sensitive information. A local attacker with low privileges could...
Stack Ideas EasyDiscuss Cross-Site Script Vulnerabilities
Stack Ideas EasyDiscuss is a Q&A and forum component provided by Malaysia-based Stack Ideas Company. Stack Ideas EasyDiscuss has a cross-site scripting vulnerability, which stems from insufficient input filtering in the processing of user avatar text. This vulnerability may lead to storage-based...
PlantUML security vulnerabilities
PlantUML is an open-source component that allows for rapid creation of diagrams from textual descriptions. Versions of PlantUML prior to 1.2026.0 contained security vulnerabilities, which stemmed from insufficient cleanup of interactive properties in GraphViz diagrams, potentially leading to...
Altium 365 security vulnerabilities
Altium 365 is a product design and development platform provided by the American company Altium. There is a security vulnerability in Altium 365, which stems from the lack of server-side input validation in the AddComment endpoint. This vulnerability may lead to storage-based cross-site scripting...
WordPress plugin: Related posts by taxonomy – Cross-site scripting vulnerabilities
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. WordPres...
MiracleLinux 4 : glibc-2.12-1.166.AXS4.7 (AXSA:2016-091:01)
The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2016-091:01 advisory. The glibc package contains standard libraries which are used by multiple programs on the system. In order to save disk space and memory, as well as to make...
MiracleLinux 7 : mariadb-5.5.64-1.el7 (AXSA:2019-4127:01)
The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2019-4127:01 advisory. mysql: MyISAM unspecified vulnerability CPU Jul 2018 CVE-2018-3058 mysql: Server: Security: Privileges unspecified vulnerability CPU Jul 2018...
Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-004260)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004260 advisory. A flaw was found in the Linux Kernel in versions after 4.5-rc1 in the way mremap handled DAX Huge Pages. This flaw allows a local attacker with access to a DAX enabl...
Qnap QTS and QuTS hero Use of Externally-Controlled Format String (CVE-2025-53407)
A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data or modify memory. We have already fixed the vulnerabili...
CVE-2026-1011
A stored cross-site scripting XSS vulnerability exists in the Altium Support Center AddComment endpoint due to missing server-side input sanitization. Although the client interface applies HTML escaping, the backend accepts and stores arbitrary HTML and JavaScript supplied via modified POST...
CVE-2025-68671 lakeFS is Missing Timestamp Validation in S3 Gateway Authentication
lakeFS is an open-source tool that transforms object storage into a Git-like repositories. LakeFS's S3 gateway does not validate timestamps in authenticated requests, allowing replay attacks. Prior to 1.75.0, an attacker who captures a valid signed request e.g., through network interception, logs...
GHSA-F2PH-GC9M-Q55F lakeFS is Missing Timestamp Validation in S3 Gateway Authentication
Impact LakeFS's S3 gateway does not validate timestamps in authenticated requests, allowing replay attacks. An attacker who captures a valid signed request e.g., through network interception, logs, or compromised systems can replay that request until credentials are rotated, even after the reques...
CVE-2026-22240
The vulnerability exists in BLUVOYIX due to an improper password storage implementation and subsequent exposure via unauthenticated APIs. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable users API to retrieve the...
kernel: libceph: fix potential use-after-free in have_mon_and_osd_map()
A use-after-free vulnerability was found in the Ceph client session initialization in the Linux kernel. The havemonandosdmap function checks map epochs without holding the appropriate locks, racing with concurrent map updates that free the old map. This can result in dereferencing freed memory...
Tagstoo Cross-Site Scripting Vulnerability
Tagstoo is a tag-based file manager developed by Pablo Andueza. Version 2.0.1 of Tagstoo contains a cross-site scripting vulnerability. This vulnerability arises from improper handling of file or custom tag inputs, which may lead to storage-based cross-site scripting attacks...
lakeFS security vulnerability
LakeFS is an open-source tool developed by Treeverse. It allows you to convert your object storage into a repository similar to Git. Versions of LakeFS prior to 1.75.0 contained security vulnerabilities. These vulnerabilities stemmed from the S3 gateway not verifying the timestamps in authenticat...
Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003476)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003476 advisory. The uas driver in the Linux kernel before 4.13.6 allows local users to cause a denial of service out-of- bounds read and system crash or possibly have unspecified...
Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003380)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003380 advisory. The uas driver in the Linux kernel before 4.13.6 allows local users to cause a denial of service out-of- bounds read and system crash or possibly have unspecified...
Each Italy Wireless Mini Router WIRELESS-N 300M has security vulnerabilities
The Each Italy Wireless Mini Router WIRELESS-N 300M is a wireless router produced by Each Italy. There is a security vulnerability in the version v28K.MiniRouter.20190211 of the Each Italy Wireless Mini Router WIRELESS-N 300M. This vulnerability stems from the lack of cleaning of the repeater AP...