248803 matches found
EUVD-2026-52059
In trustedmem, there is a possible escalation of privilege due to improper input validation. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is needed for exploitation. Patch ID: AUTO00834868; Issue ID: MSV-6533...
CVE-2026-20468
In apusys, a local escalation of privilege via a confused deputy is possible if an attacker already has System privileges. This does not require user interaction. The CVE (CVE-2026-20468) lists a patch ID AUTO00833804 and Issue ID MSV-6741. CVSSv3.1 metrics indicate a Local attack vector, Low att...
EUVD-2026-52058
In apusys, there is a possible escalation of privilege due to a confused deputy. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: AUTO00833804; Issue ID: MSV-6741...
CVE-2026-20468
In apusys, there is a possible escalation of privilege due to a confused deputy. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: AUTO00833804; Issue ID: MSV-6741...
CVE-2026-20467
In apusys, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: AUTO00837766; Issue ID: MSV-6767...
EUVD-2026-52057
In apusys, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: AUTO00837766; Issue ID: MSV-6767...
CVE-2026-20467
CVE-2026-20467 affects the apusys component, where a missing bounds check can enable local privilege escalation for an attacker already with System privileges. The vulnerability does not require user interaction. The entry notes a patch identified as AUTO00837766 and Issue ID MSV-6767 as remediat...
EUVD-2026-52054
In hevc decoder, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11104718; Issue ID: MSV-8297...
LifeOS 7.28.3
LifeOS is a Life Operating System. It knows your goals, the people who matter to you, and where you are right now, and it works to move you toward where you want to be. The engine underneath is a verifiable loop: turn any request into testable criteria, then climb until they pass. This is the fir...
CVE-2026-67972
The CVE-2026-67972 entry concerns NASA cFS v7.0.1, specifically the CF_CFDP_RecvMd() component. The vulnerability is that an attacker could influence where received content and data are stored, creating potential information disclosure. The available documents do not provide exploit details, affe...
CVE-2026-67970
The vulnerability CVE-2026-67970 affects NASA cFS v7.0.1, specifically the DS_SetDestPathCmd() function, where incorrect access control enables path traversal to reach sensitive components. The available documents confirm the affected component and the root cause (misconfigured access control), b...
📄 Telenia Software TVox 26.5.3 Command Injection
Telenia Software TVox versions 26.5.3 and below suffer from a command injection vulnerability in actionaudio.php. ------------------------------------------------------------------------------------- Telenia Software TVox = 26.5.3 actionaudio.php OS Command Injection Vulnerability...
CVE-2026-67978
The CVE pertains to NASA cFS v7.0.1: the SBN UDP interface is vulnerable to DoS by transmitting a crafted SBN frame. Reported impact is Denial of Service with HIGH severity (CVSS v3.1 base score 7.5). A PoC is indicated in the advisories; no exploitation status or patches are specified in the pro...
CVE-2026-67975
CVE-2026-67975 concerns NASA cFS v7.0.1, where an incorrect access control vulnerability in the NASA cFS stack allows an attacker to arbitrarily remove low-index subscriptions and add new streams by sending TO_LAB add/remove subscription commands. The affected component is the cFS core system; th...
CVE-2026-38444
osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting XSS via the email From-header display name. The value is extracted without sanitization in include/class.mailparse.php and stored raw in the poster field of ostthreadentry. When an unauthenticated attacker sends a reply email to an...
CVE-2026-67978
An issue in the SBN UDP interface of NASA cFS v7.0.1 allows attackers to cause a Denial of Service DoS via transmitting a crafted SBN frame...
MAL-2026-11487 Malicious code in tailwindcss-anim (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e01f26860cd01782ea3614f8dd2d144ced75af610edac79984c24d67dee41d8a index.js hides a base64-encoded payload after a long run of tab characters and executes it via evalatob... at module load, so any require/import of t...
MAL-2026-11484 Malicious code in simple-date-formatter-util-1 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f633eec2e322fce0493ff996493eebe8036c628be4ab0caf4844928d6ccdf10f Package advertises itself as a date formatting utility but ships an active install-time exfiltration payload. package.json declares a postinstall hoo...
