490127 matches found
PT-2026-86238
An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted .phar file...
CVE-2026-67397
Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root...
CVE-2026-67397
Plesk for Linux versions 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 are affected by a path traversal vulnerability (CVE-2026-67397) that allows local users with low privileges to execute arbitrary code as root . The vulnerability requires local access with low privileges and no user inte...
CVE-2026-79992 affecting package emacs for versions less than 29.4-5
CVE-2026-79992 affecting package emacs for versions less than 29.4-5. A patched version of the package is available...
CVE-2026-85063
node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...
GHSA-XQQH-3W52-Q8P7 vulnerabilities
Vulnerabilities for packages: ruby3.3-rails, ruby4.0-rails, ruby3.4-rails, ruby3.2-rails...
Important: Red Hat Security Advisory: Red Hat Quay 3.15.8
Red Hat Quay 3.15.8 is now available with bug fixes. Quay 3.15.8...
Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli
Summary orval's zod client emits each query parameter name as a double-quoted key in the generated zod.object... request-validation schema WITHOUT escaping the double quote. A " in the query parameter name closes the key and lands in object-literal context, where an injected computed property key...
CVE-2026-85309
Missing Authorization vulnerability in Supsystic Ultimate Maps by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ultimate Maps by Supsystic: from n/a through 1.5.3...
CVE-2026-84813
Unauthenticated SQL Injection in GeoDirectory = 2.8.174 versions...
CVE-2026-84814
Subscriber Privilege Escalation in Bricksforge = 3.1.8.8 versions...
CVE-2026-84848
Unauthenticated Cross Site Scripting XSS in Quick Event Manager = 9.17 versions...
CVE-2026-84776
Unauthenticated Denial of Service Attack in MalCare Security = 6.69 versions...
CVE-2026-84777
Unauthenticated Broken Authentication in Really Simple SSL = 9.8.0 versions...
CVE-2026-84765
Unauthenticated Cross Site Scripting XSS in Breadcrumb NavXT = 7.5.1 versions...
CVE-2026-84761
Unauthenticated Server Side Request Forgery SSRF in LiteSpeed Cache = 7.9 versions...
CVE-2026-84763
Unauthenticated Cross Site Scripting XSS in RTMKit = 2.1.5 versions...
CVE-2026-84766
Unauthenticated Bypass Vulnerability in FluentBooking Pro = 2.2.1 versions...