CVE-2026-22267

Dell PowerProtect Data Manager, versions prior to 19.22, contains an Incorrect Privilege Assignment vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges...

CVE-2026-25367

Missing Authorization vulnerability in NooTheme CitiLights noo-citilights allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CitiLights: from n/a through 3.7.2...

OpenSSH security update (CVE-2025-61985)

ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used...

Open WebUI 跨站脚本漏洞

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted WebUI under open source. Versions of Open WebUI prior to 0.6.44 contained a cross-site scripting vulnerability. This vulnerability arises from the possibility of storing cross-site scripting attacks when manual modifications...

CVE-2026-2650

Heap buffer overflow in Media in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-36597

Dell Avamar, versions prior to 19.12 with patch 338905, contains an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in the Security. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to information...

CVE-2026-26930

SmarterTools SmarterMail before 9526 allows XSS via MAPI requests...

CVE-2025-36597

Dell Avamar, versions prior to 19.12 with patch 338905, contains an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in the Security. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to information...

PT-2026-31528

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 147.0.7727.55 Description An integer overflow exists in the Media browser component of Google Chrome. Successful exploitation could allow a remote attacker to cause a denial-of-service through a specially crafte...

Dell SmartFabric OS10 Software 命令注入漏洞

Dell SmartFabric OS10 Software is an operating system based on Debian Linux developed by the American company Dell. Versions of Dell SmartFabric OS10 Software prior to 10.5.6.12 had a command injection vulnerability. This vulnerability stemmed from improper handling of special elements within...

VulnCheck KEV: CVE-2026-22769

Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthenticated remote attacker with knowledge of the hardcoded credential could potentially exploit this vulnerability leading to unauthorized...

CVE-2026-26930

SmarterTools SmarterMail before 9526 allows XSS via MAPI requests...

CVE-2026-2032

CVE-2026-2032 concerns Mozilla Firefox for iOS. The issue involves malicious scripts that interrupt new tab page loading, causing desynchronization between the address bar and page content. This can allow an attacker to forge arbitrary HTML under a trusted domain. The vulnerability affects Firefo...

PT-2026-8360

Name of the Vulnerable Software and Affected Versions SmarterTools SmarterMail versions prior to 9526 Description SmarterTools SmarterMail is susceptible to a cross-site scripting XSS issue through MAPI requests. The issue allows for the injection of malicious scripts via crafted MAPI requests...

PT-2026-8090

Name of the Vulnerable Software and Affected Versions NSFOCUS NIPS/IPS versions prior to Rule 5.6.11 Description The NSFOCUS Network Intrusion Prevention System NIPS / Intrusion Prevention System IPS is affected by an issue addressed with updates to the system’s detection rules in the 5.6.11...

lakeFS 路径遍历漏洞

LakeFS is an open-source tool developed by Treeverse, capable of converting your object storage into a repository similar to Git. Versions of LakeFS prior to 1.77.0 contained a path traversal vulnerability. This vulnerability stemmed from insufficient path validation in the local block adapter,...

Craft CMS 跨站脚本漏洞

Craft CMS is an open-source content management system developed by Craft CMS. Versions of Craft CMS prior to 5.14.7 contained a cross-site scripting vulnerability. This vulnerability stemmed from the direct rendering of form labels and integrated metadata that were not properly cleaned, potential...

emp3r0r 操作系统命令注入漏洞

emp3r0r is a Linux framework tool developed by Jimmy Mi. Versions of emp3r0r prior to 3.21.1 contained a vulnerability related to operating system command injection. This vulnerability stemmed from the acceptance of untrusted proxy metadata during the check-in process, which was then inserted int...

FreePBX 安全漏洞

FreePBX formerly known as Asterisk Management Portal is a set of tools developed by the FreePBX project, designed to configure Asterisk an IP telephony system through a GUI graphical web-based interface. Versions of FreePBX prior to 17.0.5 and 16.0.17 contained security vulnerabilities. These...

AZL-77610 CVE-2026-26157 affecting package busybox for versions less than 1.36.1-22

A flaw was found in BusyBox. Incomplete path sanitization in its archive extraction utilities allows an attacker to craft malicious archives that when extracted, and under specific conditions, may write to files outside the intended directory. This can lead to arbitrary file overwrite, potentiall...