EUVD-2026-94452

A vulnerability in the web-based user interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. This vulnerability is due to improper validation of...

Cisco Application Policy Infrastructure Controller API Command Injection Vulnerability

A vulnerability in the web-based management API for Cisco Application Policy Infrastructure Controller APIC could allow an authenticated, remote attacker to execute arbitrary commands as the root user. To exploit this vulnerability, the attacker must have valid administrative credentials. This...

CVE-2025-0133

CVE-2025-0133 انعكاس XSS في بوابة GlobalProtect ومدخل Palo Alto PAN-OS في معالج getconfig.esp. يتم إرجاع معامل الاستعلام user غير مشفر إلى صفحة البوابة المحصورة Captive Portal؛ يمكن للمهاجم الذي يخدع مستخدم GlobalProtect مصادقًا إلى رابط مصمم خصيصًا تنفيذ لغة JavaScript في سياق الثقة لبوابة VPN...

EUVD-2026-94373

Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package is affected by improper repository path validation in a scaffolder backend module. An authenticated user who can execute an affected...

CVE-2026-106560 Backstage: Improper repository path validation in a Scaffolder backend module

Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package is affected by improper repository path validation in a scaffolder backend module. An authenticated user who can execute an affected...

EUVD-2026-87369

Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token...

CVE-2026-46438 wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry

wger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other user's SlotEntry by supplying the victim's slotentry ID in a POST /api/v2/workoutlog/ request. The slotentry foreign key is not included...

CVE-2026-46438 wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry

wger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other user's SlotEntry by supplying the victim's slotentry ID in a POST /api/v2/workoutlog/ request. The slotentry foreign key is not included...

wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry

Summary An authenticated attacker can inject arbitrary workout log entries into any other user's SlotEntry by supplying the victim's slotentry ID in a POST /api/v2/workoutlog/ request. The slotentry foreign key is not included in the ownership verification performed by...

GHSA-RJPF-7PF5-Q54X wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry

Summary An authenticated attacker can inject arbitrary workout log entries into any other user's SlotEntry by supplying the victim's slotentry ID in a POST /api/v2/workoutlog/ request. The slotentry foreign key is not included in the ownership verification performed by...

CVE-2024-37081

CVE-2024-37081: تصعيد امتيازات محلي متعدد في VMware vCenter Server يحتوي vCenter Server على ثغرات متعددة لتصعيد الامتيازات المحلية بسبب سوء تكوين sudo. يمكن للمستخدم المحلي المُوثَّق الذي لا يمتلك صلاحيات إدارية استغلال هذه المشكلات لرفع الامتيازات إلى صلاحيات الجذر root على vCenter Server...

CVE-2026-54519

CVE-2026-54519 ai-agent-automation عدم وجود فحوصات للملكية في واجهات برمجة تطبيقات الذاكرة سمح بقراءة وحذف ذاكرة عبر المستخدمين. الإعلان الرئيسي: GHSA-qv97-83w4-ff86 نسبة الفضل للباحث: @chaitanyagarware في لمحة الحقل| القيمة ---|--- CVE| CVE-2026-54519 GHSA| GHSA-qv97-83w4-ff86 المشروع|...

CVE-2020-6287

CVE-2020-6287 SAP NetWeaver AS JAVA معالج تكوين LM تجاوز المصادقة إنشاء مستخدم Java بسيط ومستخدم إداري SAP NetWeaver هي منصة التكنولوجيا المتكاملة من SAP والأساس التقني لجميع تطبيقات SAP منذ SAP Business Suite. SAP NetWeaver هي منصة تطبيقات وتكامل موجهة نحو الخدمات توفر بيئة تطوير وتشغيل لتطبيقات...

CVE-2026-12793

CVE-2026-12793 — تصعيد صلاحيات غير مُصادَق عليه في JetFormBuilder أداة فحص وإثبات مفهوم Proof-of-concept لاستغلال CVE-2026-12793 في إضافة ووردبريس JetFormBuilder — Dynamic Blocks Form Builder Crocoblock. | ---|--- CVE| CVE-2026-12793 الإضافة| jetformbuilder المتأثرة| ≤ 3.6.2 تم الإصلاح في| 3.6.2....

WordPress Dynamic User Directory plugin <= 2.4 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Hiro Code016Hiro in WordPress Plugin Dynamic User Directory versions = 2.4...

CVE-2025-57392

CVE-2025-57392 🔒 Rapport de vulnérabilité de sécurité Produit : BenimPOS Desktop V3.0 Type de vulnérabilité : Permissions de fichiers non sécurisées Composants concernés : BenimPOS.exe, unins000.exe, System.Data.SQLite.dll Classe de vulnérabilité : CWE-276 : Permissions par défaut incorrectes...

CVE-2026-97146

Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a secondary label on the pod. If the pod has the label 'app=yunikorn' the checks limiting the user annotation content are not run. The label is used to identify the YuniKorn application itself in the...

CVE-2026-92393

Apache YuniKorn 1.9.0 and earlier does not implement label and user annotation checks for workload UPDATE action bypassing all checks. Workloads in YuniKorn are defined as the following Kubernetes objects: "deployments", "replicasets", "statefulsets", "daemonsets", "jobs", "cronjobs". The CREATE...

CVE-2026-42720

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Sarah Giles Dynamic User Directory dynamic-user-directory allows Blind SQL Injection.This issue affects Dynamic User Directory: from n/a through 2.4...

CVE-2025-32462-32463-Detection-Script-

CVE-2025-32462-32463-Detection-Script- ثغرات حرجة في Sudo تتيح للمستخدمين المحليين الحصول على صلاحيات الجذر على لينكس، مما يؤثر على التوزيعات الرئيسية فيما يلي وصف موجز للثغرات: CVE-2025-32462 درجة CVSS: 2.8 - Sudo قبل الإصدار 1.9.17p1، عند استخدامه مع ملف sudoers يحدد مضيفًا ليس هو المضيف الحالي...