4353 matches found
PT-2026-7060
Name of the Vulnerable Software and Affected Versions FAST/TOOLS versions R9.01 through R10.04 Description The software is susceptible to Cross-Site Request Forgery CSRF. An attacker could compromise a user’s account by having the user access a crafted link. Recommendations Update to a version...
PT-2026-7052
Name of the Vulnerable Software and Affected Versions FAST/TOOLS versions R9.01 through R10.04 Description A flaw exists in FAST/TOOLS by Yokogawa Electric Corporation where the library version can be revealed on a web page. This disclosed information may be leveraged by attackers to facilitate...
Cube 安全漏洞
Cube is a semantic layer for building data applications developed by Cube OpenSource. There were security vulnerabilities in versions of Cube between 0.27.19 and 1.5.13, as well as in versions before 1.4.2 and 1.0.14. These vulnerabilities stemmed from the possibility of privilege escalation when...
Yokogawa FAST/TOOLS 安全漏洞
Yokogawa FAST/TOOLS is a real-time operation management and visualization software developed by Yokogawa Electric Corporation. There are security vulnerabilities in the Yokogawa FAST/TOOLS R9.01 version up to R10.04. These vulnerabilities stem from the support for older versions of SSL/TLS, which...
Craft CMS SQL注入漏洞
Craft CMS is an open-source content management system developed by Craft CMS. Versions 4.0.0-RC1 to 4.16.17, and 5.0.0-RC1 to 5.8.21 of Craft CMS have SQL injection vulnerabilities. These vulnerabilities stem from improper cleaning of the criteriaorderBy parameter input, which may lead to SQL...
PT-2026-7138
Craft is a platform for creating digital experiences. From 5.0.0-RC1 to 5.8.21, Craft has a stored XSS via Entry Type names. The name is not sanitized when displayed in the Entry Types list. This vulnerability is fixed in 5.8.22...
Super-Linter 命令注入漏洞
Super-Linter is a code checker developed by Super Linter. Versions 6.0.0 to 8.3.0 of Super-Linter have a command injection vulnerability, which stems from improper handling of specially crafted file names. This vulnerability may lead to command injection attacks...
CVE-2026-25793
Nebula is a scalable overlay networking tool. In versions from 1.7.0 to 1.10.2, when using P256 certificates which is not the default configuration, it is possible to evade a blocklist entry created against the fingerprint of a certificate by using ECDSA Signature Malleability to use a copy of th...
CVE-2026-25793
Nebula is a scalable overlay networking tool. In versions from 1.7.0 to 1.10.2, when using P256 certificates which is not the default configuration, it is possible to evade a blocklist entry created against the fingerprint of a certificate by using ECDSA Signature Malleability to use a copy of th...
CVE-2026-25793 Nebula Has Possible Blocklist Bypass via ECDSA Signature Malleability
Nebula is a scalable overlay networking tool. In versions from 1.7.0 to 1.10.2, when using P256 certificates which is not the default configuration, it is possible to evade a blocklist entry created against the fingerprint of a certificate by using ECDSA Signature Malleability to use a copy of th...
CVE-2026-25628
Qdrant is a vector similarity search engine and vector database. From 1.9.3 to before 1.16.0, it is possible to append to arbitrary files via /logger endpoint using an attacker-controlled ondisk.logfile path. Minimal privileges are required read-only access. This vulnerability is fixed in 1.16.0...
@kimuson/claude-code-viewer (>=0.4.2-beta.2, <=0.5.9), @machina.at/cli (>=19.24.1, <=19.43.0) +20 more potentially affected by CVE-2026-25725 via @anthropic-ai/claude-code (>=2.0.0, <=2.0.76)
@anthropic-ai/claude-code NPM version =2.0.0, =0.4.2-beta.2, =19.24.1, =1.0.0-broken, =0.0.1-rc.1, =0.12.0, =0.5.2, =0.12.1, =0.0.0, =0.1.2, =1.9.1, =1.9.1, =1.9.6 and more Source cves: CVE-2026-25725 Source advisory: OSV:GHSA-FF64-7W26-62RF...
CVE-2026-24050
Zulip (open-source team collaboration tool) is affected by a stored XSS issue in administrative actions on user profiles in group names and channel names, across Zulip server versions 5.0 up to, but not including, 11.5. The vulnerability requires user interaction with the problematic object and i...
CVE-2026-24851
OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.8.5 to v1.11.2 openfga-0.2.22= Helm chart = openfga-0.2.51, v.1.8.5 = docker = v.1.11.2 are vulnerable to improper policy enforcement when certain Check call...
OESA-2026-1281 python-wheel security update
A built-package format for Python. A wheel is a ZIP-format archive with a specially formatted filename and the .whl extension. It is designed to contain all the files for a PEP 376 compatible install in a way that is very close to the on-disk format. Security Fixes: wheel is a command line tool f...
CVE-2026-23624
GLPI is a free asset and IT management software package. In versions starting from 0.71 to before 10.0.23 and before 11.0.5, when remote authentication is used, based on SSO variables, a user can steal a GLPI session previously opened by another user on the same machine. This issue has been patch...
CVE-2024-43181
IBM Concert 1.0.0 through 2.1.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system...
CVE-2024-43181
IBM Concert 1.0.0 through 2.1.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system...
CVE-2024-40685
IBM Operations Analytics – Log Analysis versions 1.3.5.0 through 1.3.8.3 and IBM SmartCloud Analytics – Log Analysis are vulnerable to a cross-site request forgery CSRF vulnerability that could allow an attacker to trick a trusted user into performing unauthorized actions...