2436 matches found
Microsoft DNS: undisclosed vulnerability (ZAI-2026-Z2AF14)
Not disclosed. Details are not yet publicly disclosed...
Stripe: undisclosed vulnerability (ZAI-2026-PDG48R)
Not disclosed. Details are not yet publicly disclosed...
Frappe Auto Repeat update_reference lacks reference-document permission check, allowing unauthorized document references
Frappe Auto Repeat updatereference Lacks Reference-Document Permission Check, Allowing Unauthorized Document References Vulnerability Overview Auto Repeat in Frappe Framework automatic repetition / subscription documents provides a whitelisted method used to bind a reference document to an...
Redis: undisclosed vulnerability (ZAI-2026-ZW22XM)
Not disclosed. Details are not yet publicly disclosed...
Seafile server-controlled sync path can escape the client worktree (macOS/Linux)
Seafile server-controlled sync path can escape the client worktree macOS/Linux Vulnerability Overview The Seafile client's sync module applies file diffs delivered by the server during the checkout phase, and the target path of rename operations is fully controlled by the server. The validity che...
Linux kernel MRP: vector attribute parsing errors break applicant state handling
Linux kernel MRP: vector attribute parsing errors break applicant state handling Vulnerability Overview The Linux kernel MRP IEEE 802.1 Multiple Registration Protocol PDU parser mishandles zero-length vector attributes, event counts and attribute-value advancement in mrppduparsevecattr, breaking...
SLBrowser: undisclosed vulnerability (ZAI-2026-5IS294)
Not disclosed. Details are not yet publicly disclosed...
Ollama: undisclosed vulnerability (ZAI-2026-F52CMV)
Not disclosed. Details are not yet publicly disclosed...
pdnsd: undisclosed vulnerability (ZAI-2026-O9SNMR)
Not disclosed. Details are not yet publicly disclosed...
wget2: undisclosed vulnerability (ZAI-2026-4QSX0T)
Not disclosed. Details are not yet publicly disclosed...
Redis: undisclosed vulnerability (ZAI-2026-TOCS8A)
Not disclosed. Details are not yet publicly disclosed...
Kubernetes: undisclosed vulnerability (ZAI-2026-BJK0C7)
Not disclosed. Details are not yet publicly disclosed...
Beyond Compare: undisclosed vulnerability (ZAI-2026-6I43U8)
Not disclosed. Details are not yet publicly disclosed...
Marriott: undisclosed vulnerability (ZAI-2026-PA8K1Z)
Not disclosed. Details are not yet publicly disclosed...
Typora: undisclosed vulnerability (ZAI-2026-HCZTU1)
Not disclosed. Details are not yet publicly disclosed...
FineReport: undisclosed vulnerability (ZAI-2026-WP2SMY)
Not disclosed. Details are not yet publicly disclosed...
WordPress: undisclosed vulnerability (ZAI-2026-F0YIO5)
Not disclosed. Details are not yet publicly disclosed...
Typora: undisclosed vulnerability (ZAI-2026-DC0XEA)
Not disclosed. Details are not yet publicly disclosed...
Frappe Google OAuth state is client-controllable, enabling redirects and authorization-flow abuse
Frappe Google OAuth State Is Client-Controllable, Enabling Redirects and Authorization-Flow Abuse Vulnerability Overview The Google integrations in Frappe Framework Gmail/Calendar/Drive, etc. share a unified OAuth authorization entry point and callback handler. Before the fix, the authorization...
Frappe list filter values rendered unescaped, leading to XSS
Frappe List Filter Values Rendered Unescaped, Leading to XSS Vulnerability Overview When rendering the search/filter template of the website-side list view in Frappe Framework, the search keywords from the query string and the page path are embedded directly into the HTML output, with key positio...
Frappe GDPR Personal Data Download Request ownership error leads to IDOR, allowing download of other users' PII
Frappe GDPR Personal Data Download Request Ownership Error Leads to IDOR, Allowing Download of Other Users' PII Vulnerability Overview When generating a user's personal data export file, the Personal Data Download Request feature that Frappe Framework provides for GDPR compliance failed to...
DokuWiki Revert plugin renders changelog usernames unescaped, leading to stored XSS
DokuWiki Revert plugin renders changelog usernames unescaped, leading to stored XSS Vulnerability Overview DokuWiki's built-in revert admin plugin, when listing changelog edit records, HTML-escapes edit summaries but outputs the changelog user field verbatim. For authentication backends that do n...
Portainer Edge Agent endpoints do not validate EdgeStack assignment, allowing unauthorized reads of unassigned stack files and forged status reports
Portainer Edge Agent Endpoint EdgeStack Assignment Authorization Bypass Vulnerability Overview Two categories of Portainer Server endpoints serving Edge Agents -- Edge Stack deployment-file retrieval and deployment status reporting -- resolve the reporting environment from the Edge ID in the...
WeKan Avatar Localization follows redirects, bypassing SSRF protections (RedirectBleed)
WeKan Avatar Localization Follows Redirects, Bypassing SSRF Protections RedirectBleed Vulnerability Overview WeKan allows users to set an external avatar URL in their profile, and the server-side avatar localization feature fetches that URL and caches the avatar as a local attachment. Although SS...
Joomla com_installer update list stored XSS (description/detailsurl unescaped)
Joomla cominstaller Update List Stored XSS CVE-2026-48952 Vulnerability Overview The extension update list in the Joomla CMS administrative backend the update view of cominstaller renders the description and detailsurl fields of extension update information without HTML escaping, constituting a...
WebKit single-bug RCE: crafted web content yields AAR/AAW/PC-hijack in content process
Summary A memory-corruption vulnerability in Apple's WebKit engine is reachable from maliciously crafted web content. Apple's public advisory understates the impact as an "unexpected process crash" and notes it was addressed with improved memory handling. In practice the bug is a single-shot remo...
lwIP: undisclosed vulnerability (ZAI-2026-S05AIC)
Not disclosed. Details are not yet publicly disclosed...
FFmpeg: undisclosed vulnerability (ZAI-2026-XSJHOP)
Not disclosed. Details are not yet publicly disclosed...
Redis: undisclosed vulnerability (ZAI-2026-H6KAFF)
Not disclosed. Details are not yet publicly disclosed...
Redis: undisclosed vulnerability (ZAI-2026-19YSKJ)
Not disclosed. Details are not yet publicly disclosed...
wget2: undisclosed vulnerability (ZAI-2026-EXL6WR)
Not disclosed. Details are not yet publicly disclosed...
wget2: undisclosed vulnerability (ZAI-2026-OTTOUS)
Not disclosed. Details are not yet publicly disclosed...
Suricata: undisclosed vulnerability (ZAI-2026-ZGY90J)
Not disclosed. Details are not yet publicly disclosed...
Sogou Browser: undisclosed vulnerability (ZAI-2026-DFWIYP)
Not disclosed. Details are not yet publicly disclosed...
Databricks: undisclosed vulnerability (ZAI-2026-BVF26F)
Not disclosed. Details are not yet publicly disclosed...
GStreamer: undisclosed vulnerability (ZAI-2026-MWMUZZ)
Not disclosed. Details are not yet publicly disclosed...
GStreamer: undisclosed vulnerability (ZAI-2026-JTMJZE)
Not disclosed. Details are not yet publicly disclosed...
systemd-resolved: undisclosed vulnerability (ZAI-2026-27DEG0)
Not disclosed. Details are not yet publicly disclosed...
Remitly: undisclosed vulnerability (ZAI-2026-LWR18R)
Not disclosed. Details are not yet publicly disclosed...
Redis: undisclosed vulnerability (ZAI-2026-THQVY2)
Not disclosed. Details are not yet publicly disclosed...
libevent: undisclosed vulnerability (ZAI-2026-R6B4XO)
Not disclosed. Details are not yet publicly disclosed...
GStreamer: undisclosed vulnerability (ZAI-2026-C3517B)
Not disclosed. Details are not yet publicly disclosed...
Redis: undisclosed vulnerability (ZAI-2026-50TYQ1)
Not disclosed. Details are not yet publicly disclosed...
Redis: undisclosed vulnerability (ZAI-2026-UHBN8E)
Not disclosed. Details are not yet publicly disclosed...
Redis: undisclosed vulnerability (ZAI-2026-3Z1LHC)
Not disclosed. Details are not yet publicly disclosed...
FFmpeg: undisclosed vulnerability (ZAI-2026-NVXRBA)
Not disclosed. Details are not yet publicly disclosed...
JeecgBoot: undisclosed vulnerability (ZAI-2026-RF3FJB)
Not disclosed. Details are not yet publicly disclosed...
WPS Mail: undisclosed vulnerability (ZAI-2026-S2G6BW)
Not disclosed. Details are not yet publicly disclosed...