15121 matches found
CVE-2026-57469 Cross-Site Request Forgery (CSRF) in KUNBUS PiCtory
Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery CSRF vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the context of an authenticated operator,...
CVE-2026-57469
Nozomi Networks Labs identifies a CSRF vulnerability (CWE-352) in the web-based configuration backend of KUNBUS PiCtory v2.16.0. The issue allows a remote unauthenticated attacker to perform state-changing actions within an authenticated operator session by tricking a victim into submitting craft...
CVE-2026-19794
The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.56 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute...
CVE-2025-10308
The Astro Booking Engine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This is due to missing nonce validation on the options deletion functionality. This makes it possible for unauthenticated attackers to delete all plugin settings...
CVE-2026-73292 Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation
Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/id/password endpoint accepts a cross-site request using the authenticated user's semaphore session cookie without CSRF protection or current-password confirmation, allowing an unauthenticated attacker to...
CVE-2026-65789
Use after free in Windows DNS allows an unauthorized attacker to execute code over a network...
CVE-2026-64912
Stack-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally...
CVE-2026-62820
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows DNS allows an unauthorized attacker to execute code over a network...
EUVD-2026-56773
Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network...
EUVD-2026-56770
Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally...
EUVD-2026-56709
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally...
EUVD-2026-56665
Heap-based buffer overflow in RPC Runtime allows an unauthorized attacker to execute code over a network...
EUVD-2026-56649
Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to bypass a security feature over a network...
CVE-2026-68815
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally...
CVE-2026-68795
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally...
CVE-2026-68794
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally...
EUVD-2026-56427
Improper neutralization of special elements used in a command 'command injection' in Microsoft Office allows an unauthorized attacker to execute code locally...
CVE-2026-18129
Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MITM position to leak credentials for external SQL connections...
Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network...