283935 matches found
CVE-2026-49265 vulnerabilities
Vulnerabilities for packages: kubeflow-volumes-web-app, open-webui, k8s-sidecar, jupyter-base-notebook, ggshield, kubeflow-katib, dask-kubernetes, kserve, kubeflow-pipelines-visualization-server, az, kubeflow-pipelines, datadog-agent, kubeflow-jupyter-web-app...
CVE-2026-14157
Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands via a crafted file uploaded through the web management interface...
CVE-2026-14157
Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands via a crafted file uploaded through the web management interface...
CVE-2026-14157
A Use of an Externally Controlled Format String vulnerability exists in ASUS Router modules . A remote authenticated user can execute arbitrary commands by uploading a crafted file through the web management interface . No specific affected versions, root cause details, or remediation steps are p...
EUVD-2026-90453
Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands via a crafted file uploaded through the web management interface...
CVE-2026-14157
Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands via a crafted file uploaded through the web management interface...
CLEANSTART-2026-VJ67556 Spring Data Commons contains a vulnerability that can lead to a Denial of Service (DoS) condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPaylo...
Security vulnerability affects the apache-nifi package. Spring Data Commons contains a vulnerability that can lead to a Denial of Service DoS condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPayload, when an attacker sends a specially crafted...
EUVD-2026-90429
AJA HELO Plus firmware before 2.1.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers with network access to inject malicious JavaScript by setting an unsanitized eParamIDSystemName value through the /config?action=set web configuration API. Attackers can...
PT-2026-105789
Summary Decepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users configure their own LLM credentials to any OpenAI-compatible...
CVE-2026-55393: Improper Limitation of a Pathname to a Restricted Directory
Unvalidated pathnames in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 PackBot and 1.7.9 FirstLook allows remote unauthenticated attackers to read configuration and security parameters on Teledyne FLIR PackBot and FirstLook robots running this software via path traversal...
CVE-2026-101322: Insertion of Sensitive Information Into Sent Data
In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's Authorization header to outgoing requests without checking the destination origin. In deployments using authentication, an attacker could induce a us...
CVE-2026-14983: Missing Authentication for Critical Function
Missing authentication in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 allows remote unauthenticated attackers to achieve denial of service against Teledyne FLIR PackBot robots running this software via misuse of the reboot endpoint...
PT-2026-103740
Name of the Vulnerable Software and Affected Versions Ad Inserter – Ad Manager & AdSense Ads versions prior to 2.8.19 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when a site administrator...
PT-2026-103744
The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr-data' parameter in all versions up to, and including, 6.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticate...
PT-2026-103731
Name of the Vulnerable Software and Affected Versions Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More versions prior to 5.5.1.4 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected...
TREX MES 6.07.17.00090 / TrexDCAS MES 6.05.14.00074 SQL Injection
TREX MES versions 6.07.17.00090 and earlier and TrexDCAS MES versions 6.05.14.00074 and earlier contain an SQL injection vulnerability in web API sql parameter handling...
CVE-2026-102394: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through 6.8.4...
PT-2026-105790
Summary Decepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users configure their own LLM credentials to any OpenAI-compatible...
PT-2026-105865
Summary Open WebUI fetches user-supplied URLs on the server for RAG URL ingestion and web search, and screens the resolved addresses so internal destinations cannot be reached. That screen decided whether a destination was external by asking Python's standard library whether the address is global...
CVE-2026-96268: Improper Neutralization of Input During Web Page Generation
The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr-data' parameter in all versions up to, and including, 6.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticate...