302562 matches found
ROS-20260914-73-0102
The vulnerability of Google Chrome’s user interface is related to insufficient validation of entered data. Exploiting this vulnerability can allow a malicious actor to bypass security measures by using a specially created HTML page...
Azure Cosmos DB Authentication Bypass
The vulnerability of the Azure Cosmos DB database management system is related to the ability to bypass authentication using a user-controlled key. Exploiting this vulnerability allows an attacker to perform brute-force attacks remotely...
PT-2026-91092
Cross-site scripting vulnerability exists in CPSL-08P1EN. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...
Important: ecs-service-connect-agent
Issue Overview: An Envoy proxy handling HTTP/3 connections can dereference a null transport socket option during the selection of a connection pool. This null pointer dereference is a CWE-476 flaw that may cause the process to crash or terminate unexpectedly, leading to a denial of service for th...
Important: ecs-service-connect-agent
Issue Overview: An Envoy proxy handling HTTP/3 connections can dereference a null transport socket option during the selection of a connection pool. This null pointer dereference is a CWE-476 flaw that may cause the process to crash or terminate unexpectedly, leading to a denial of service for th...
CVE-2026-54178: Improper Limitation of a Pathname to a Restricted Directory
backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 6.8.12 and 7.0.35, HasUploadFields::uploadMultipleFilesToDisk in src/app/Models/Traits/HasUploadFields.php trusts...
PT-2026-91068
Cross-site request forgery vulnerability exists in multiple Contec products. If a user views a specially crafted page while logged in to the affected product, unintended operations may be performed...
PT-2026-91540
An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive user data...
Important: gstreamer1-plugins-base
Issue Overview: GStreamer OGG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target mu...
PT-2026-91668
A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27, watchOS 27. An app may be able to fingerprint the user...
CVE-2026-43789: Missing Authorization
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access user-sensitive data...
CVE-2026-43741: Improper Access Control
A logic issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access protected user data...
EUVD-2023-60664
An issue was discovered in the ProofreadPage extension for MediaWiki through 1.39.3. It leaks information about a suppressed user via the API and config variables...
Linux Distros Unpatched Vulnerability : CVE-2025-56536
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A stored cross-site scripting XSS vulnerability in opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payloa...
ROS-20260914-73-0080
The vulnerability of the Paint component in Google Chrome and Microsoft Edge browsers relates to the ability to bypass authentication by using a user-controlled password. Exploiting this vulnerability allows an attacker to manipulate data integrity through a specially created HTML page...
Debian dsa-6498 : network-manager-l2tp - security update
The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6498 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6498-1 [email protected] https://www.debian.org/securit...
Malicious code in instacart-user (npm)
Source: ossf-package-analysis 874a5b26864cb92b47627790269c6a382107aa52df40e08b357a0e00eea63968 The OpenSSF Package Analysis project identified 'instacart-user' @ 999.9.9 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...
Malicious code in info-user-wind-book-sanitize (npm)
Source: amazon-inspector 2d4dc5a534fea20aed19a4422309665c2027ecc15737ec3222b93f3a598ec91f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in import-float-omega-user-eta (npm)
Source: amazon-inspector 68b9d72ef4a5adf2927a1577844ade2d0903be998fe38061cbfa62e1633027df This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...