292540 matches found
USN-8730-4 linux-azure-fde, linux-intel-iotg, linux-kvm, linux-oracle, linux-xilinx-zynqmp vulnerability
A security issue was discovered in the Linux kernel. An attacker could possibly use this to compromise the system. This update corrects flaws in the following subsystems: - IPv6 networking; - Netfilter;...
CVE-2026-94382 Beszel before 0.19.0 Insecure Direct Object Reference via user-alerts
Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that allows any authenticated user to create or delete alerts on systems they cannot access. Attackers can supply arbitrary system IDs in the request body to...
CVE-2026-94382 Beszel before 0.19.0 Insecure Direct Object Reference via user-alerts
Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that allows any authenticated user to create or delete alerts on systems they cannot access. Attackers can supply arbitrary system IDs in the request body to...
EUVD-2026-83896
Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only write permission in a single namespace could attach a completion callback whose URL host matched the configured callback address allowlist,...
Exploit for CVE-2026-94095
Netcore NBR200V2 – Remote Command Injection in the Traceroute...
WordPress WP Support Plus Responsive Ticket System plugin <= 9.1.2 - Unauthenticated Stored XSS via File Upload vulnerability
Unauthenticated Stored XSS via File Upload vulnerability discovered by Ayush Srivastava in WordPress Plugin WP Support Plus Responsive Ticket System versions = 9.1.2...
CVE-2026-47321
The CompressionFilter class uses ZLib to deflate and inflate data sent and received. When we inflate incoming data, the filter does not control the resulting size, and create a buffer no matter what. Some compressed data may have a compression ration greater than 1 thousand, leading to an...
libtiff: libtiff: Arbitrary code execution via process_command_opts() function
A flaw was found in libtiff. An attacker can exploit a vulnerability in the processcommandopts function within tools/tiffcrop.c to execute arbitrary code. This could lead to a complete compromise of the affected system...
PrettyPrague
PrettyPrague GenDigital Avast Antivirus ゼロデイ権限昇格の脆弱性 アンチマルウェアベンダーにおけるもう一つのゼロデイ脆弱性です。確信はありませんが、この脆弱性は他のGenDigital製品（AVG、Nortonなど）にも影響する可能性があると考えています。 現時点では、PoCはAvast Antivirusの任意のバージョンと互換性があります。 このPoCは、Avast Sandboxの脆弱性を悪用してSAMデータベースをダンプし、完全なSYSTEMシェルを起動します。本稿執筆時点では、このPoCは完全にパッチ適用済みのAvast Antiviru...
CVE-2026-88467
The CRMEB Knowledge-Paid System (specifically crmeb_zzff_class version 1.4.4 ) contains a vulnerability in a backend verification function. The function returns an incorrect value type, which triggers errors and results in the leakage of sensitive information . No specific remediation steps, expl...
CVE-2026-82165: Incorrect Default Permissions
Dell Command | Integration Suite for System Center, versions prior to 6.7.2, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure...
PT-2026-96267
CRMEB Knowledge-Paid System crmeb zzff class 1.4.4 has a backend verification function that returns the wrong type of value, causing errors and leaking sensitive information...
mtk_vpu Heap Buffer Overflow DoS
The vulnerability of the vpuloadfirmware function in the drivers/media/platform/mediatek/vpu/mtkvpu.c file of the MediaTek VPU video processor driver for Linux operating systems is related to the assignment of a null pointer. Exploiting this vulnerability could allow an attacker to cause a system...
PT-2026-96221
Name of the Vulnerable Software and Affected Versions Dell Command | Integration Suite for System Center versions prior to 6.7.2 Description Incorrect default permissions allow a low privileged attacker with local access to potentially cause information disclosure. Recommendations Update to versi...
When the Directory Becomes the Weapon: Understanding NTDS.dit Theft
When the Directory Becomes the Weapon: Understanding NTDS.dit Theft By Maulik Maheta and Henry Bernabe · September 21, 2026 Executive Summary While adversaries continually update their attack tools, their fundamental techniques, such as extracting credentials from Active Directory's NTDS.dit and...
PT-2026-96166
Name of the Vulnerable Software and Affected Versions KubeEdge versions 1.16.0 through 1.21.1 KubeEdge versions 1.22.0 through 1.22.1 KubeEdge versions 1.23.0 Description The DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.go fails to sufficiently validate archive entry names when...
EUVD-2026-84204
CRMEB Knowledge-Paid System crmebzzffclass 1.4.4 has a backend verification function that returns the wrong type of value, causing errors and leaking sensitive information...
CVE-2026-88467
CRMEB Knowledge-Paid System crmebzzffclass 1.4.4 has a backend verification function that returns the wrong type of value, causing errors and leaking sensitive information...
PT-2026-96640
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Security flaws were identified within the IPv6 networking and Netfilter subsystems, which could potentially allow an attacker to compromise the system. Recommendations At the moment, the...
PT-2026-96102
Name of the Vulnerable Software and Affected Versions Beszel versions prior to 0.19.0 Description An insecure direct object reference occurs in the 'POST' and 'DELETE' '/api/beszel/user-alerts' endpoints. This allows authenticated users to create or delete alerts for systems they are not authoriz...