167997 matches found
CVE-2026-69127 Kirby: System path exposure from error messages in the REST API
Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauthenticated API users. This vulnerability affects all Kirby...
CVE-2026-66000
Frappe (full-stack web framework) has an unrestricted access issue in Document Follow notifications prior to versions 16.23.0 and 15.112.0, where recipient permission checks are not re-evaluated for email data. This allows users whose access has been revoked or reduced to continue receiving docum...
EUVD-2026-51397
CodeIgniter: SQL injection in Query Builder deleteBatch when used with where conditions...
EUVD-2026-51396
CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure...
CVE-2026-64638
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires...
CVE-2026-19082 Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-read from zero-count ASCII EXIF entries in copy_string_tags
Imager versions from 0.4502 before 1.034 for Perl may expose adjacent heap bytes via strlen over-read from zero-count ASCII EXIF entries in copystringtags. copystringtags computes an ASCII EXIF tag's length as entry-size - 1 to strip the trailing NUL. A zero-count ASCII entry sets entry-size to 0...
CVE-2026-66058
CVE-2026-66058 affects the Frappe framework. Prior to versions 16.20.0 and 15.112.0 , an authenticated user could gain unrestricted access to the Document Follow API (update_follow). The issue is fixed in those versions. The available sources confirm the vulnerable behavior as an unauthorized/unr...
CVE-2026-56818
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, the RedisArrayAggregator Redis codec clears retained partial aggregate state when the maxNestedArrayDepth limit is exceeded, but it does not clear the same state when the sibling...
CVE-2026-56818
CVE-2026-56818 affects Netty’s Redis codec (RedisArrayAggregator) where the maxElements path fails to clear retained partial aggregate state, causing a memory leak and attacker-controlled state to remain across a security-limit exception. The issue is triggered when a nested array header exceeds ...
CVE-2026-17594
CVE-2026-17594 affects Nexus Repository 3 CE/Pro versions 3.0.0–3.94.x. The root cause is an authorization mismatch in the repository-creation UI: a delegated repository-admin (scoped to a specific format) could cause a repository of a different, unauthorized format to be created because authoriz...
CVE-2026-17597
Nexus Repository 3 contains a Server-Side Request Forgery SSRF vulnerability in the email configuration verification feature. A user holding the nexus:settings:update permission could submit arbitrary host and port values to the email test/verification endpoint, causing the server to attempt...
EUVD-2026-54500
Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, a field-level permissions bypass exposes restricted DocType fields. This issue is fixed in versions 16.23.0 and 15.112.0...
ROOT-APP-PYPI-CVE-2023-50447 CVE-2023-50447 in pillow - Patched by Root
Root has patched CVE-2023-50447 in the pillow package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-54059 CVE-2026-54059 in pillow - Patched by Root
Root has patched CVE-2026-54059 in the pillow package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2024-28219 CVE-2024-28219 in pillow - Patched by Root
Root has patched CVE-2024-28219 in the pillow package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-42308 CVE-2026-42308 in pillow - Patched by Root
Root has patched CVE-2026-42308 in the pillow package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-42310 CVE-2026-42310 in pillow - Patched by Root
Root has patched CVE-2026-42310 in the pillow package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2023-4863 CVE-2023-4863 in pillow - Patched by Root
Root has patched CVE-2023-4863 in the pillow package for Root:PyPI. Multiple fixed versions available...