48417 matches found
CVE-2026-49035
creationtimestamp| type| source ---|---|--- 2026-07-23 22:00:49+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrdtlrt3us2w 2026-07-23 22:24:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrduveaath23...
EUVD-2026-48427
Cwe-269 vulnerability in Johnson Controls victor Web on Windows allows capec-233. This issue affects victor Web: before 7.1...
EUVD-2026-48425
Victor SSRF vulnerability in Johnson Controls CCure 9000 and victor application server allows Server Side Request Forgery. This issue affects CCure 9000 and victor application server: from 2.9 through 3.0...
CVE-2026-21653
Johnson Controls CCure 9000 and Victor Application Server are affected by a SSRF vulnerability (CVE-2026-21653) impacting versions 2.9 through 3.0. The issue enables Server-Side Request Forgery due to an insecure handling of external requests within the Victor application server. CVSS 4.0 base sc...
NPM: React Router: Open redirect leading to XSS
NPM: React Router: Open redirect leading to XSS vulnerability discovered by ? in WordPress Npm react-router-dom versions = 6.30.2, = 6.30.4...
Prototype Pollution
Overview Affected versions of this package are vulnerable to Prototype Pollution in the lookup function when handling HTTP/2 requests. An attacker can cause the application to crash by sending specially crafted HTTP method values that exploit inherited object properties, leading to a denial of...
find-my-way: DDoS with HTTP2
Impact Remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server. The short version is that lookup passes req.method into find, and find indexes this.treesmethod. Since this.trees is a normal object, HTTP/2 method values like constructor, toString, or proto can resolve...
CVE-2026-65706 FFmpeg 3.0 - 8.1.2 vf_swaprect Out-of-Bounds Write via NV12 Frame Processing
FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vfswaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filterframe function reuses a temporary row buffer sized for plane 0's...
CVE-2026-65706
CVE-2026-65706 affects FFmpeg versions 3.0–8.1.2. The vulnerability lies in the vf_swaprect video filter, where the filter_frame() reuses a temporary row buffer sized for plane 0’s single-byte pixel step across all planes. This leads to an out-of-bounds write: an 18-byte memcpy is performed into ...
CVE-2026-64785
SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting. This vulnerability is addressed in swift-nio-http2...
Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes
A Russian state-supported espionage group spent months reading Western mailboxes through a then-unknown flaw in Zimbra's webmail client. The payload goes after the last 90 days of email, the organization's entire email directory, the password saved in the browser and the codes kept for two-factor...
CVE-2026-60871
creationtimestamp| type| source ---|---|--- 2026-07-23 17:48:31+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...
Updated apache packages fix security vulnerabilities
The updated packages fix security vulnerabilities: Apache HTTP Server: modldap per-dir use-after-free. CVE-2026-29167 Apache HTTP Server: modproxyftp XSS. CVE-2026-29170 Apache HTTP Server: modproxyhtml buffer overflow. CVE-2026-34355 Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow...
CVE-2026-44909
Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by setting SETTINGSINITIALWINDOWSIZE to 0 or withholding WINDOWUPDATE frames, causing the server to buffer complete response bodies ...
MINI-JGHC-2PC6-XHC5
Bulletin has no description...
CVE-2026-24552
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in John-Michael L'Allier Create allows Blind SQL Injection. This issue affects Create: from n/a through 2.5.3...
EUVD-2026-48142
Shop Manager Cross Site Scripting XSS in Tabs = 2.5 versions...
EUVD-2026-48139
Author Cross Site Scripting XSS in Machete = 5.2 versions...
CVE-2026-65538
CVE-2026-65538 : WordPress Machete plugin ≤ 5.2 contains a Cross Site Scripting (XSS) vulnerability in the author context. The CVSS v3.1 base score is 5.9 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. The provided documents do not specify the exact vulnerable component, explo...
