153135 matches found
CVE-2026-88012 Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded
Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints do not apply entryPoints..transport.respondingTimeouts.readTimeout because the timeout is enforced on a TCP connection and the HTTP/3 server has no corresponding QUIC stream...
CVE-2026-81048
Dell ThinOS 10 , versions prior to 2605_10.2616 , is affected by a Command Injection vulnerability (Improper Neutralization of Special Elements used in a Command). An unauthenticated attacker with adjacent network access could exploit this to achieve Remote Code Execution , with a CVSS 3.1 score ...
CVE-2026-81048
Dell ThinOS 10, versions prior to 260510.2616, contain an Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Remote Code execution...
EUVD-2026-75561
Dell ThinOS 10, versions prior to 260510.2616, contain an Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Remote Code execution...
CVE-2026-81052
Dell ThinOS 10, versions prior to 260510.2616, contain a Download of Code Without Integrity Check vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to arbitrary code execution...
CVE-2026-81052
Dell ThinOS 10 , versions prior to 2605_10.2616 , is affected by a Download of Code Without Integrity Check vulnerability. An unauthenticated attacker with physical access could potentially exploit this flaw to achieve arbitrary code execution , resulting in high impact to confidentiality, integr...
EUVD-2026-75560
Dell ThinOS 10, versions prior to 260510.2616, contain a Download of Code Without Integrity Check vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to arbitrary code execution...
CVE-2026-88940 knowns through 0.33.0 Arbitrary Directory Enumeration via workspace browse endpoint
knowns through 0.33.0 fails to validate the path query parameter in the workspace browse endpoint, allowing remote attackers to enumerate arbitrary directories on the host filesystem. Attackers can traverse the directory structure to locate project directories and identify targets for further...
CVE-2026-88899 knowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory Header
knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can supply arbitrary directory paths to execute file operations outside the project root on the host system...
CVE-2026-88004
Traefik is an open source HTTP reverse proxy and load balancer. From 3.2.0 until 3.7.13, Traefik entrypoint defenses aliasHeadersStrategy, underscoreHeadersStrategy, and forwardedHeaders inspect req.Header but not req.Trailer, allowing an unauthenticated client to submit an aliasing or trusted...
CVE-2026-84821
Unauthenticated Broken Access Control in WP Fast Total Search = 1.82.284 versions...
CVE-2026-84816
Unauthenticated Cross Site Scripting XSS in WPCS = 1.3.2 versions...
CVE-2026-84819
Unauthenticated Cross Site Scripting XSS in WPAdverts = 2.3.3 versions...
CVE-2026-81796
Unauthenticated Broken Authentication in WP Travel = 12.0.3 versions...
CVE-2026-81805
Unauthenticated Privilege Escalation in SiteSkite = 2.1.5 versions...
CVE-2026-81799
Unauthenticated Broken Access Control in Return Refund and Exchange For WooCommerce = 4.6.4 versions...
CVE-2026-81800
Unauthenticated SQL Injection in Verified Reviews Avis Vérifiés = 2.4.6 versions...
CVE-2026-81804
Unauthenticated Sensitive Data Exposure in ZHBackup – Backup, Restore & Migration = 2.4.2 versions...