1171 matches found
CVE-2026-54365 CentreStack < 17.3 Unauthenticated User Creation via Deserialization in GSNamespace.dll
CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll that allows unauthenticated attackers to create arbitrary local OS user accounts by supplying a crafted base64-encoded XML string to exposed API endpoints. Attackers can send a malicious...
CVE-2026-66035 affecting package libssh2 for versions less than 1.11.1-5
CVE-2026-66035 affecting package libssh2 for versions less than 1.11.1-5. A patched version of the package is available...
CVE-2026-65882
CVE-2026-65882 affects the Joomla Extension joomdle.com, specifically Joomdle versions prior to 3.1.1. The vulnerability is a reflected XSS in the moodle wrapper endpoint, exploitable via the goto url parameter. The CVSS-based assessment in the documents shows Network attack vector, required user...
CVE-2026-48145
The CVE concerns Apache Thrift’s C++ bindings, specifically the TSSLSocket matchName() path, where improper validation of certificates with host mismatches is reported. Affected versions are Thrift before 0.24.0. The vulnerability arises from RFC 6125 wildcard handling in the certificate host mis...
CVE-2026-56444 affecting package unbound for versions less than 1.25.2-1
CVE-2026-56444 affecting package unbound for versions less than 1.25.2-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-42770 affecting package openssl for versions less than 3.3.7-4
CVE-2026-42770 affecting package openssl for versions less than 3.3.7-4. A patched version of the package is available...
CVE-2026-61425 Joomla Extension - balbooa.com - Authentication bypass in Gridbox < 1.6.0
Joomla Extension - balbooa.com - Authentication bypass in Gridbox 1.6.0 - The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially leading to full admin access...
CVE-2026-60029
The CVE concerns Joomla extension Quix Page Builder Pro (thethemexpert) with an authenticated stored XSS flaw. The issue allows an authenticated builder user to break out of id/class fields that render to public pages. Affected version(s) are Quix Page Builder Pro before 6.2.1; remediation is upg...
CVE-2026-63757
SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc sessions method returns attached session UUIDs without authentication and accepts arbitrary session fields with no ownership verification. Unauthenticated attackers can enumerate session UUIDs and...
CVE-2026-9537
Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison. The decode method compares the supplied signature to the recomputed HMAC with Perl's eq operator, which stops at the first differing byte, so the comparison time varies with the number of...
PT-2026-60976
Name of the Vulnerable Software and Affected Versions joe versions prior to 4.6-4.1 Description An issue allows arbitrary command execution through the use of a malicious tags file. Recommendations Update to version 4.6-4.1...
CVE-2026-58319
Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication. An unauthenticated attacker with network access to the FE HTTP service could perform unauthorized administrative operations, potentially affecting cluster integrity and availability and leading to...
PYSEC-2026-3383 FractionalMaxPool and FractionalAVGPool heap out-of-bounds acess
Impact An input poolingratio that is smaller than 1 will trigger a heap OOB in tf.rawops.FractionalMaxPool and tf.rawops.FractionalAvgPool. Patches We have patched the issue in GitHub commit 216525144ee7c910296f5b05d214ca1327c9ce48. The fix will be included in TensorFlow 2.11.0. We will also cher...
CVE-2026-50721 affecting package libreswan for versions less than 4.15-2
CVE-2026-50721 affecting package libreswan for versions less than 4.15-2. A patched version of the package is available...
CVE-2026-59796
CVE-2026-59796 affects JetBrains TeamCity prior to 2026.1.2. The issue arises from improper permission checks that could allow pipeline modification. Documented impact is pipeline modification with high impact on confidentiality and integrity (per CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). N...
GHSA-FF52-PH69-CF7X vulnerabilities
Vulnerabilities for packages: buildah, cue, skopeo, cluster-api, docker-machine-driver-linode, github-mcp-server, nova, nri-kafka, crossplane-provider-aws-sns, crossplane-provider-aws-dynamodb, knative-eventing, boring-registry, octo-sts, net-kourier, mongo-tools, crossplane-provider-aws-ec2,...
CVE-2026-42506 affecting package dasel for versions less than 2.8.1-4
CVE-2026-42506 affecting package dasel for versions less than 2.8.1-4. A patched version of the package is available...
CVE-2026-42502 affecting package keda for versions less than 2.14.1-14
CVE-2026-42502 affecting package keda for versions less than 2.14.1-14. A patched version of the package is available...
CVE-2026-48934 affecting package nodejs for versions less than 24.17.0-1
CVE-2026-48934 affecting package nodejs for versions less than 24.17.0-1. An upgraded version of the package is available that resolves this issue...