263204 matches found
CVE-2026-16552
Removed by vendor...
CVE-2026-14865
In Progress® Telerik® UI for AJAX prior to v2026.2.708, the internal LayoutBuilder control processes client-state XML without disabling DTD processing, allowing unauthenticated denial of service via recursive XML entity expansion...
CVE-2026-13187
In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider type input may be tampered with, potentially altering dialog processing and enabling chained exploitation...
CVE-2026-62145 Local Privilege Escalation in Gaia Portal
A vulnerability in Check Point Gaia Portal allows an authenticated attacker with read-only Gaia Portal privileges to execute commands with root privileges...
EUVD-2026-47697
In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of content submitted to the RadEditor PDF export feature may allow an authenticated attacker to trigger server-side requests to arbitrary hosts, resulting in outbound network connections and potential exposure of...
CVE-2026-13188
The vulnerability CVE-2026-13188 affects Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708. In DialogHandler, request parameters may be tampered with, potentially altering server-side dialog behavior and enabling chained exploitation. Impact as stated: no confidentiality leakage, but inte...
CVE-2026-13187 DialogHandler Provider Type Tampering Vulnerability in Telerik UI for ASP.NET AJAX
In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider type input may be tampered with, potentially altering dialog processing and enabling chained exploitation...
CVE-2026-13187
The CVE-2026-13187 vulnerability affects Progress Telerik UI for ASP.NET AJAX (prior to v2026.2.708). The issue concerns the DialogHandler provider type input, which can be tampered with, potentially altering dialog processing and enabling chained exploitation. Affected product: Telerik UI for AJ...
EUVD-2026-47691
In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnerability in the file-based persistence storage provider can be exploited when the storage key is derived from user-controlled input, enabling attacker-controlled deserialization and remote code execution...
CVE-2026-13183
The vulnerability CVE-2026-13183 affects In Progress Telerik UI for ASP.NET AJAX, specifically the RadAsyncUpload component prior to version 2026.2.708. The root cause is a flaw in upload metadata processing that may allow an attacker to infer cryptographic validity through measurable timing diff...
CVE-2026-13183 RadAsyncUpload Upload Metadata Timing Oracle Vulnerability in Telerik UI for ASP.NET AJAX
In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload metadata processing may leak cryptographic validity through measurable timing differences, enabling remote attackers to recover protected metadata values...
EUVD-2026-47688
In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload metadata processing may leak cryptographic validity through measurable timing differences, enabling remote attackers to recover protected metadata values...
CVE-2026-13182
The vulnerability CVE-2026-13182 affects Progress Telerik UI for ASP.NET AJAX (RadAsyncUpload) up to version 2026.2.708. The issue arises from RadAsyncUpload client-state processing that can distinguish decrypt failures from invalid-JSON parse failures, creating an oracle that may leak protected ...
CVE-2026-54478
In NLnet Labs Unbound 1.18.0 up to and including 1.25.1, when Unbound listens on a 'proxy-protocol-port' interface with 'answer-cookie: yes', the RFC 9018 server-cookie SipHash is computed over the proxy's wire address instead of the PROXYv2-declared client. One server cookie obtained through a...
CVE-2026-50252
In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined...
CVE-2026-16270
Open Mercato does not validate regex rules. An attacker with privileges to create the regex rule can add an unsafe regex to a field. When someone provide the proper string it can result in a DoS attack. This issue was fixed in version 0.6.4...
EUVD-2026-47649
Open Mercato does not validate regex rules. An attacker with privileges to create the regex rule can add an unsafe regex to a field. When someone provide the proper string it can result in a DoS attack. This issue was fixed in version 0.6.4...
Duplicate Advisory: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-pm35-fqvh-cq5g. This link is maintained to preserve external references. Original Description n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An...
CVE-2026-65598
n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This lets an attacker plant a crafted...