197685 matches found
CVE-2026-75496
Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the file to a publicly accessible directory. A remote, authenticated attacker with administrative privileges could upload executable files and achieve remote code execution. Fixed in 153ec1c...
CVE-2026-13478
The Zephyr ext2 filesystem driver validates the on-disk block bitmap in ext2initfs subsys/fs/ext2/ext2impl.c by passing fsblocks = sblockscount - sfirstdatablock to ext2bitmapcountset. That helper subsys/fs/ext2/ext2bitmap.c treats its argument as a number of bits and reads one bitmap byte per...
CVE-2026-13216
The virtio PCI driver drivers/virtio/virtiopci.c parses a device's PCI capability list during driver initialization. In virtiopcireadcap the device-supplied capability length byte caplen read from PCI config space via pcieconfread was only checked with asserttmp.caplen == capstructsize. That asse...
CVE-2026-75497 Webkul QloApps SQL injection
Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'boquery' parameter in the 'CustomerMessage.php' file. Fixed in 123c97c...
EUVD-2026-65585
Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the file to a publicly accessible directory. A remote, authenticated attacker with administrative privileges could upload executable files and achieve remote code execution. Fixed in 153ec1c...
CVE-2026-75496 Webkul QloApps improper file upload validation
Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the file to a publicly accessible directory. A remote, authenticated attacker with administrative privileges could upload executable files and achieve remote code execution. Fixed in 153ec1c...
CVE-2026-75496 Webkul QloApps improper file upload validation
Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the file to a publicly accessible directory. A remote, authenticated attacker with administrative privileges could upload executable files and achieve remote code execution. Fixed in 153ec1c...
CVE-2026-75496
Webkul QloApps contains an improper file upload validation flaw. The application fails to properly validate uploaded file extensions or MIME types before moving the file to a publicly accessible directory . A remote, authenticated attacker with administrative privileges can exploit this by upload...
Out-of-bounds Write
Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to Out-of-bounds Write via the processing of DTD validation errors with long QName prefixes and during validation against untrusted XML Schemas. An attacker can execute arbitrary co...
Use After Free
Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to Use After Free in the xmlTextReader process when DTD validation and XInclude expansion are enabled. An attacker can execute arbitrary code or cause a denial of service by...
Unchecked Return Value
Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to Unchecked Return Value in the canonicalize process. An attacker can bypass signature validation by supplying invalid canonicalized XML that is incorrectly accepted as valid...
browse-mcp has an arbitrary file write via unconfined download and state paths
Impact browserdownload wrote a fetched file to joinsavedir, filename with no validation of savedir, and browsersavestate / browserloadstate honored an explicit path unchanged. The MCP caller controls these arguments a malicious MCP client, or an autonomous agent steered by indirect prompt injecti...
CVE-2026-55557
browse-mcp is a Playwright-based headless-browser MCP server for MCP-capable agents. Prior to 0.8.2 , the browser_download function writes a fetched response body to join(save_dir, filename) without validating the caller-controlled save_dir, and browser_save_state / browser_load_state honor a cal...
CVE-2026-79675
NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java function, allowing attackers to inject dangerous JVM flags. Attackers can supply malicious options like -agentpath, -javaagent, or @argfile to Stanford wrapper classes to achieve arbitrary...
UBUNTU-CVE-2026-79675
NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java function, allowing attackers to inject dangerous JVM flags. Attackers can supply malicious options like -agentpath, -javaagent, or @argfile to Stanford wrapper classes to achieve arbitrary...
CVE-2026-55532
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, MCP HTTP Stream validateorigin uses requestorigin.startswithallowed, allowing the attacker-controlled localhost.attacker.com HTTP origin to satisfy the localhost allowlist. A webpage can send Content-Type: text/plain requests...
CVE-2025-71407
Rejected reason: This CVE ID has been rejected as a duplicate...
CVE-2025-71346
Rejected reason: This CVE ID has been rejected as a duplicate...