248640 matches found
CVE-2025-70796
An unauthenticated path traversal vulnerability exists in the web management interface of WTI Wireless Technology, Inc. version 3.5.0.r 2024/05/24 00:00:00. An unauthenticated attacker can craft malicious HTTP requests containing traversal sequences to access files outside of the intended web roo...
PT-2026-57253
Name of the Vulnerable Software and Affected Versions ZITADEL versions 3.0.0-rc.1 through 3.4.11 ZITADEL versions 4.0.0-rc.1 through 4.15.1 Description External JWT Identity Provider validation in the internal/idp/providers/jwt/session.go file skips expiration handling when an incoming token omit...
CVE-2026-51119
An issue in Invixium IXM WEB v.2.3.85.25 allows an attacker to escalate privileges via the /SystemUsers/CreateAppUser components...
PT-2026-57368
Name of the Vulnerable Software and Affected Versions ps facetedsearch versions 3.0.0 through 4.0.3 Description An unauthenticated PHP Object Injection flaw exists in the ps facetedsearch module. The module rebuilds search filters from the request URL, where values for slider filters, specificall...
The vulnerability of the Python programming language’s HTTP client module allows attackers to inject arbitrary HTTP headers.
The vulnerability of the Python programming language’s HTTP client module is related to the failure to take measures to neutralize crlf sequences. Exploiting this vulnerability allows a remote attacker to inject arbitrary HTTP headers...
CVE-2026-51119
Invixium IXM WEB 2.3.85.25 is affected. The issue allows privilege escalation via the /SystemUsers/CreateAppUser component, as described in CVE-2026-51119, with CVSS 3.1 base score 9.1 (CRITICAL). No specific root-cause, vulnerable version ranges, exploit details, or fixes are provided beyond thi...
ROS-20260710-73-0033
The vulnerability of the Go programming language is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
PT-2026-57297
RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq management HTTP API accepts oversized valid JSON bodies on with decode and direct request paths because read complete body checks the accumulated size before the final chunk but not the final...
CVE-2025-70796
An unauthenticated path traversal in the web management interface of WTI (Wireless Technology, Inc.), version 3.5.0.r 2024/05/24 00:00:00, allows crafted HTTP requests with traversal sequences to access files outside the web root, potentially disclosing sensitive system files and configuration da...
PT-2026-57232
Name of the Vulnerable Software and Affected Versions tarteaucitron.js versions prior to 1.33.0 Description The software fails to verify if an element is a legitimate button or if the associated cookie belongs to a handled service when calling the tarteaucitron.cookie.purge function on elements...
PT-2026-57267
Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.5.0 Description An authenticated attacker can read arbitrary files accessible to the web server process. This occurs because the displaySig function within the ActionlogController concatenates the filename route...
Linux Distros Unpatched Vulnerability : CVE-2026-58501
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Zeep is a Python SOAP client. From 4.0.0 before 4.3.3, Settings.forbidexternal is defined but not enforced when parsing WSDL or XSD documents, allowing transiti...
MAL-2026-10104 Malicious code in px8my (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7da37dfbaa4b355a75e38c244bc5614299ecc5a1f3bc1dd072fdc7c4f2dc13b9 px8my's main entry is a browser-side script that injects a full-screen iframe pointing at a hardcoded remote URL https://mfmz.gzhrjq.cn/H.html?c=0gjr...
Malicious code in security-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2450dc325921e41fd15c24339c29dc86bef36424dd6f8447c07cffd219f3955a package.json declares the package's own name as both a dependency and devDependency pointing to http://pack.nppacks.com/npm/security-node, a...
MAL-2026-10107 Malicious code in security-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2450dc325921e41fd15c24339c29dc86bef36424dd6f8447c07cffd219f3955a package.json declares the package's own name as both a dependency and devDependency pointing to http://pack.nppacks.com/npm/security-node, a...
Malicious code in rallycoding (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 789e913282e371428b19e015e619b6a3dd6c8d9938ad0e08a1f37d0248d28e0a package.json declares 'rallycoding' as its own dependency, resolved from an unauthenticated plain-HTTP URL http://pack.nppacks.com/npm/rallycoding...
CVE-2026-57054
A Use of Incorrectly-Resolved Name or Reference vulnerability in the URL filtering plugin of Juniper Networks Junos OS on MX Series allows an unauthenticated, network-based attacker to bypass web filtering and access downstream resources that should be unreachable. If an MX Series device is...
CVE-2026-57021
An Out-of-bounds Write vulnerability in the http-gatekeeper http-gk of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service DoS. If an SRX Series device is configured for remote-access VPN with pre-logon compliance check, a...
CVE-2026-55689
OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, OpenFGA's OIDC authenticator skipped JWT audience validation when authn.method was set to oidc, authn.oidc.issuer was configured, and authn.oidc.audience was not set, allowing a token minted for an unrelated...
CVE-2026-53961
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the AWS SES bounce webhook at POST /webhooks/aws verified that SNS messages were signed by Amazon but did not bind them to trusted TopicArn values, allowing any AWS account holder to publish...