1993 matches found
Cockpit Web Console < 360 - Remote Code Execution
Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH...
EUVD-2026-62934
In Splunk SOAR versions below 8.6.0, a user who holds the OnPrem Broker role could write files outside the intended Automation Broker log directory. The vulnerability is possible because Automation Broker log uploads accept crafted filename input before writing log files. For more information see...
CVE-2026-47729 affecting package squid for versions less than 6.13-5
CVE-2026-47729 affecting package squid for versions less than 6.13-5. A patched version of the package is available...
CVE-2026-57262
A vulnerability has been identified in LOGO! Soft Comfort All versions V9. Affected products use a static, hardcoded AES master key to encrypt project files. This could allow a local attacker to extract the master key from the application files or memory and use it to decrypt project files or...
EUVD-2026-55159
Joomla Extension - fabrikar.com - Remote code execution in Fabrik 4.6.7 - An unauthenticated attacker could execute arbitrary code by using the ajaxcalc feature of the calc plugin...
WordPress < 7.0.3 - Stored XSS vulnerabiliity
Stored XSS vulnerabiliity discovered by Naveen S and Ajmal Moochingal in WordPress core versions 7.0.3...
CVE-2026-28177
Popup Maker WordPress plugin
NPM: Electron: Sandboxed iframes can launch external protocol handlers
NPM: Electron: Sandboxed iframes can launch external protocol handlers vulnerability discovered by ? in WordPress Npm electron versions 39.8.8...
NPM: Electron: DevTools embedder handler executes arbitrary files via shell open
NPM: Electron: DevTools embedder handler executes arbitrary files via shell open vulnerability discovered by ? in WordPress Npm electron versions 39.8.9...
NPM: Electron: contextBridge object copy honors prototype setters
NPM: Electron: contextBridge object copy honors prototype setters vulnerability discovered by ? in WordPress Npm electron versions 39.8.9...
NPM: Electron: shell.openPath path validation bypass via embedded null byte
NPM: Electron: shell.openPath path validation bypass via embedded null byte vulnerability discovered by ? in WordPress Npm electron versions 39.8.6...
NPM: Electron: Cross-origin iframe can position native autofill popup
NPM: Electron: Cross-origin iframe can position native autofill popup vulnerability discovered by ? in WordPress Npm electron versions 39.8.8...
NPM: Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size
NPM: Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size vulnerability discovered by ? in WordPress Npm electron versions 39.8.10...
NPM: Electron: Parent process code-sign check is spoofable
NPM: Electron: Parent process code-sign check is spoofable vulnerability discovered by ? in WordPress Npm electron versions 39.8.8...
CVE-2026-55953 affecting package erlang for versions less than 26.2.5.21-3
CVE-2026-55953 affecting package erlang for versions less than 26.2.5.21-3. A patched version of the package is available...
CVE-2026-14920
CVE-2026-14920 affects AcyMailing
CVE-2026-55970 affecting package thrift for versions less than 0.24.0-1
CVE-2026-55970 affecting package thrift for versions less than 0.24.0-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-58040 affecting package nodejs for versions less than 24.18.1-1
CVE-2026-58040 affecting package nodejs for versions less than 24.18.1-1. An upgraded version of the package is available that resolves this issue...
EUVD-2026-51529
Missing authorization in Checkmk 2.5.0p10, 2.4.0p35, 2.3.0p49, and 2.2.0 EOL allows an authenticated user lacking the "Edit foreign Reports" permission to modify reports owned by other users...