115144 matches found
@aquacloud_ai/aqc-charts (>=0.1.1, <=0.1.3), @arkxos/arkos-system (>=0.1.1, <=0.1.10) +71 more potentially affected by CVE-2026-45249 via echarts (6.0.0)
echarts NPM version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on echarts and may be impacted: - @aquacloudai/aqc-charts =0.1.1, =0.1.1, =5.1.121, =0.1.1, =1023.48.0, =1023.0.0, =1023.0.0, =1023.0.0, =1023.0.0, =1023.0.0, =1023.0.0, =0.19.0,...
omec-project amf Vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability has been found in omec-project amf up to 2.1.1. This affects an unknown part of the component NGSetupRequest Handler. Such manipulation leads to memory corruption. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. It is best practic...
CVE-2026-8174 Cross-site Request Forgery
Zohocorp Zoho Mail wordpress plugin is vulnerable to Cross-Site request forgery CSRF. This issue affects Zoho Mail wordpress plugin versions before 1.6.2...
Security Bulletin: Vulnerability in IBM WebSphere Application (CVE-2025-14917) affects IBM PowerVM Novalink.
Summary IBM WebSphere Libery Profile is used by IBM PowerVM Novalink. IBM PowerVM Novalink has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2025-14917 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty could...
CVE-2026-9524 xianrendzw EasyReport REST Endpoint execute sql injection
A flaw has been found in xianrendzw EasyReport up to 2.0.17.0522Beta. Affected by this issue is the function execute of the component REST Endpoint. Executing a manipulation of the argument reportParams can lead to sql injection. The attack can be launched remotely. The vendor was contacted early...
PT-2026-46324
Name of the Vulnerable Software and Affected Versions Rosaleen versions prior to 2.9 Description An unauthenticated Local File Inclusion LFI exists, which allows an attacker to include files from the local file system without requiring authentication. Recommendations Update to a version newer tha...
FastNetMon 安全漏洞
FastNetMon is a high-performance DDoS detector/sensor developed by Pavel Odintsov. It is built using multiple packet capture engines. Versions of FastNetMon Community Edition 1.2.9 and earlier contained a security vulnerability. This vulnerability stemmed from the log function in the MikroTik...
PT-2026-46330
Name of the Vulnerable Software and Affected Versions Nexio versions prior to 1.10.1 Description An unauthenticated Local File Inclusion LFI exists, which allows an attacker to read arbitrary files from the local file system without requiring authentication. Recommendations Update to a version...
EasyReport SQL注入漏洞
EasyReport is a simple and easy-to-use web reporting tool developed by TomDeng. Versions of EasyReport 2.0.17.0522Beta and earlier have a SQL injection vulnerability. This vulnerability stems from improper handling of the reportParams parameter in the execute function of the REST Endpoint...
view_component 安全漏洞
viewcomponent is an open-source framework developed by ViewComponent, designed for building reusable and testable view components. There are security vulnerabilities in the viewcomponent version 3.0.0 to 4.9.0. These vulnerabilities arise from the system’s testing entry point using File.realpath ...
PT-2026-43386
Missing Authorization vulnerability in Magepeople inc. WpTravelly allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WpTravelly: from n/a through 2.1.5...
Chatwoot SQL注入漏洞
Chatwoot is an open-source application developed by Chatwoot itself. It serves as an alternative to proprietary solutions such as customer engagement suites, intercom systems, Zendesk, and Salesforce service clouds. Versions of Chatwoot from 2.2.0 to 4.11.2 contained a SQL injection vulnerability...
Atlassian Confluence 8.9.0 < 9.2.20 / 9.3.1 < 10.2.11 (CONFSERVER-103707)
The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-103707 advisory. - This HTTP Request/Response Smuggling vulnerability allows an unauthenticated attacker to manipulate HTTP requests in a way that causes the server...
Atlassian Confluence 9.1.0 < 9.2.20 / 9.3.1 < 10.2.11 (CONFSERVER-103709)
The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-103709 advisory. - This BASM Broken Authentication & Session Management vulnerability allows an unauthenticated attacker to perform actions as another user which ha...
CVE-2026-45438
Missing Authorization vulnerability in WebToffee Smart Coupons for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Smart Coupons for WooCommerce: from n/a before 2.3.0...
CVE-2026-32389
Missing Authorization vulnerability in Linethemes NanoCare allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects NanoCare: from n/a before 1.2.2...
CVE-2026-24586 WordPress Newses theme <= 2.0.0.77 - Broken Access Control vulnerability
Missing Authorization vulnerability in Themeansar Newses allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Newses: from n/a through 2.0.0.77...
CVE-2026-43828
Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue. In the affected...
CVE-2026-48852
PuTTY 0.71 before 0.84 is affected by an assertion failure in ECDSA signature verification (CVE-2026-48852). The public data specifies affected version range and impact but provides no remediation details in the documents. The CVSS v3.1 vector yields a LOW overall impact (availability loss) with ...