1166 matches found
CVE-2026-26226
beautiful-mermaid versions prior to 0.1.3 contain an SVG attribute injection issue that can lead to cross-site scripting XSS when rendering attacker-controlled Mermaid diagrams. User-controlled values from Mermaid style and classDef directives are interpolated into SVG attribute values without...
CVE-2026-1642 affecting package nginx for versions less than 1.28.2-1
CVE-2026-1642 affecting package nginx for versions less than 1.28.2-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-21353 DNG SDK | Integer Overflow or Wraparound (CWE-190)
DNG SDK versions 1.7.1 2410 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...
CVE-2025-71132 affecting package kernel for versions less than 6.6.121.1-1
CVE-2025-71132 affecting package kernel for versions less than 6.6.121.1-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-22695 affecting package libpng for versions less than 1.6.54-1
CVE-2026-22695 affecting package libpng for versions less than 1.6.54-1. An upgraded version of the package is available that resolves this issue...
WordPress Keap Official Opt-in Forms plugin < 1.0.12 - Admin+ Stored XSS vulnerability
Admin+ Stored XSS vulnerability discovered by MINGYOUNG BAN in WordPress Plugin Keap Official Opt-in Forms versions 1.0.12...
Amazon Linux 2 : aws-nitro-enclaves-cli, --advisory ALAS2NITRO-ENCLAVES-2026-086 (ALASNITRO-ENCLAVES-2026-086)
The version of aws-nitro-enclaves-cli installed on the remote host is prior to 1.4.4-0. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2026-086 advisory. openssl: rust-openssl Use-After-Free in Md::fetch and Cipher::fetch CVE-2025-3416 Tenable has extracted...
PT-2026-6215
Name of the Vulnerable Software and Affected Versions Ajay Better Search versions through 4.2.1 Description The software contains a flaw due to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This could allow an attacker to inject...
CVE-2026-22226
A command injection vulnerability may be exploited after the admin's authentication in the VPN server configuration module on TP-Link Archer BE230 v1.2 and Archer AX73 v2. Successful exploitation could allow an attacker to gain full administrative control of the device, resulting in severe...
CVE-2026-0897 affecting package keras for versions less than 3.3.3-6
CVE-2026-0897 affecting package keras for versions less than 3.3.3-6. A patched version of the package is available...
PT-2026-53869
Name of the Vulnerable Software and Affected Versions GLib affected versions not specified Description An off-by-one error exists in the gvs tuple is normal function within the glib/gvariant-serialiser.c file. The issue occurs during an alignment padding check where the bounds check incorrectly...
firefox: thunderbird: Clickjacking issue, information disclosure in the PDF Viewer component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Clickjacking issue, information disclosure in the PDF Viewer component...
CVE-2026-24829
Out-of-bounds Write, Heap-based Buffer Overflow vulnerability in Is-Daouda is-Engine.This issue affects is-Engine: before 3.3.4...
firefox: thunderbird: Clickjacking issue, information disclosure in the PDF Viewer component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Clickjacking issue, information disclosure in the PDF Viewer component...
PT-2026-5198
Name of the Vulnerable Software and Affected Versions Drupal Mini site versions prior to 3.0.2 Description A flaw exists in Drupal Mini site that allows for Stored Cross-Site Scripting XSS due to unsafe actions with defined privileges. This allows an attacker to inject malicious scripts into the...
AZL-75470 CVE-2026-24809 affecting package ntopng for versions less than 5.2.1-4
An issue from the component luaGrunerror in dependencies/lua/src/ldebug.c in praydog/REFramework version before 1.5.5 leads to a heap-buffer overflow when a recursive error occurs...
CVE-2026-24829 Out-of-bounds write in is-Engine
Out-of-bounds Write, Heap-based Buffer Overflow vulnerability in Is-Daouda is-Engine.This issue affects is-Engine: before 3.3.4...
KLA90859 ACE vulnerability in Mozilla Thunderbird
A remote code execution vulnerability was found in Mozilla Thunderbird. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories MFSA2026-07 Related products Mozilla-Thunderbird CVE list CVE-2026-0818 warning Solution Update to the latest version Download...
CVE-2026-23974
CVE-2026-23974 describes a Missing Authorization vulnerability in WordPress theme Golo (Golo) where access control levels are improperly configured. Affected versions are Golo up to < 1.7.5. Public disclosures from Patchstack and CVE listings confirm Broken Access Control due to insufficient a...
firefox: thunderbird: Spoofing issue in the DOM: Copy & Paste and Drag & Drop component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Spoofing issue in the DOM: Copy & Paste and Drag & Drop component...