2436 matches found
Redis: undisclosed vulnerability (ZAI-2026-LNZGNG)
Not disclosed. Details are not yet publicly disclosed...
Chasquid: undisclosed vulnerability (ZAI-2026-7Y6YOD)
Not disclosed. Details are not yet publicly disclosed...
Redis: undisclosed vulnerability (ZAI-2026-1Q6UU5)
Not disclosed. Details are not yet publicly disclosed...
Pixiv: undisclosed vulnerability (ZAI-2026-G2X87A)
Not disclosed. Details are not yet publicly disclosed...
Redis: undisclosed vulnerability (ZAI-2026-VLANCP)
Not disclosed. Details are not yet publicly disclosed...
JeecgBoot: undisclosed vulnerability (ZAI-2026-P75QQS)
Not disclosed. Details are not yet publicly disclosed...
Nacos: undisclosed vulnerability (ZAI-2026-3076EK)
Not disclosed. Details are not yet publicly disclosed...
GStreamer: undisclosed vulnerability (ZAI-2026-138GI8)
Not disclosed. Details are not yet publicly disclosed...
wolfSSL: undisclosed vulnerability (ZAI-2026-T3I9LK)
Not disclosed. Details are not yet publicly disclosed...
bank-dispute: undisclosed vulnerability (ZAI-2026-41WNIX)
Not disclosed. Details are not yet publicly disclosed...
Apple Safari: undisclosed vulnerability (ZAI-2026-BVBFCK)
Not disclosed. Details are not yet publicly disclosed...
FineReport: undisclosed vulnerability (ZAI-2026-PEQ0L2)
Not disclosed. Details are not yet publicly disclosed...
Frappe comment template context values unescaped, leading to XSS
Frappe Comment Template Context Values Unescaped, Leading to XSS Vulnerability Overview When rendering the Jinja template of the website-side comment component in Frappe Framework, context values such as the page path, referenced doctype, and document name are concatenated directly into HTML...
126 Mail: undisclosed vulnerability (ZAI-2026-6NPKQY)
Not disclosed. Details are not yet publicly disclosed...
Vaultwarden /events/collect cross-organization event injection
Vaultwarden /events/collect Cross-Organization Event Injection Vulnerability Overview The Bitwarden protocol's event-reporting endpoint POST /events/collect receives user operation events submitted by clients entry viewing, password-field copying, editing, etc., and the server writes them into...
FFmpeg: undisclosed vulnerability (ZAI-2026-D9L696)
Not disclosed. Details are not yet publicly disclosed...
GStreamer: undisclosed vulnerability (ZAI-2026-URWEH2)
Not disclosed. Details are not yet publicly disclosed...
Dingtalk: undisclosed vulnerability (ZAI-2026-2PJVT2)
Not disclosed. Details are not yet publicly disclosed...
Exim: undisclosed vulnerability (ZAI-2026-1O9YNW)
Not disclosed. Details are not yet publicly disclosed...
SmartDNS: undisclosed vulnerability (ZAI-2026-81HOU3)
Not disclosed. Details are not yet publicly disclosed...
FreeBSD: undisclosed vulnerability (ZAI-2026-1RHT80)
Not disclosed. Details are not yet publicly disclosed...
Microsoft DNS: undisclosed vulnerability (ZAI-2026-Z2AF14)
Not disclosed. Details are not yet publicly disclosed...
inDrive: undisclosed vulnerability (ZAI-2026-4TYTBA)
Not disclosed. Details are not yet publicly disclosed...
Typora: undisclosed vulnerability (ZAI-2026-50LRC9)
Not disclosed. Details are not yet publicly disclosed...
QQ Mail: undisclosed vulnerability (ZAI-2026-2FWFM1)
Not disclosed. Details are not yet publicly disclosed...
Suricata: undisclosed vulnerability (ZAI-2026-SSNI71)
Not disclosed. Details are not yet publicly disclosed...
Redis: undisclosed vulnerability (ZAI-2026-UHBN8E)
Not disclosed. Details are not yet publicly disclosed...
Frappe Discussion Reply Markdown rendering allows unsafe tags, leading to stored XSS
Frappe Discussion Reply Markdown Rendering Allows Unsafe Tags, Leading to Stored XSS Vulnerability Overview The Discussion feature on the website side of Frappe Framework supports Markdown replies; after a reply is saved, the system pushes the rendered Markdown result in real time to all online...
VMware Workstation/Fusion NAT vulnerability: a guest VM admin can disrupt or intercept other guest VMs' network connections
VMware Workstation/Fusion NAT Network Packet Management Flaw Allows a Guest VM to Disrupt or Intercept Other Guest VMs' Network Connections CVE-2026-22715 Vulnerability Overview VMware Workstation and Fusion contain a logic flaw CWE-923, communication channel not correctly restricted to intended...
SMTP MIME message/rfc822: encapsulation parser state not reset, bypassing attachment filename and decoded-content inspection
SMTP MIME message/rfc822: encapsulation parser state not reset, bypassing attachment filename and decoded-content inspection Vulnerability Overview Suricata's SMTP MIME parser incompletely resets state when processing message/rfc822 encapsulated messages: after entering the inner message, the...
wolfSSL: undisclosed vulnerability (ZAI-2026-R0NL2I)
Not disclosed. Details are not yet publicly disclosed...
TikTok: undisclosed vulnerability (ZAI-2026-3XMTX2)
Not disclosed. Details are not yet publicly disclosed...
Databricks: undisclosed vulnerability (ZAI-2026-BVF26F)
Not disclosed. Details are not yet publicly disclosed...
Linux kernel 6lowpan: NHC entry use-after-free on error path
In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpannhcdouncompression looks up an NHC descriptor while holding lowpannhclock. If the descriptor has no uncompress callback, the error path drops the lock before printing...
Frappe Auto Repeat update_reference lacks reference-document permission check, allowing unauthorized document references
Frappe Auto Repeat updatereference Lacks Reference-Document Permission Check, Allowing Unauthorized Document References Vulnerability Overview Auto Repeat in Frappe Framework automatic repetition / subscription documents provides a whitelisted method used to bind a reference document to an...
glibc resolver: undisclosed vulnerability (ZAI-2026-TJS14X)
Not disclosed. Details are not yet publicly disclosed...
ALSCO: undisclosed vulnerability (ZAI-2026-3XCY8S)
Not disclosed. Details are not yet publicly disclosed...
Frappe Connected App OAuth flow: insufficient permission checks and external redirect
Frappe Connected App OAuth Flow: Insufficient Permission Checks and External Redirect Vulnerability Overview Connected App in Frappe Framework is an OAuth2 client integration mechanism; its whitelisted method is used to generate an authorization URL for a user and write the authorization state in...
WeKan /metrics unconditionally trusts X-Forwarded-For, allowing whitelist IP spoofing (MetricsBleed)
WeKan /metrics Unconditionally Trusts X-Forwarded-For, Allowing Whitelist IP Spoofing MetricsBleed Vulnerability Overview WeKan's Prometheus /metrics endpoint restricts access via an IP whitelist only configured monitoring IPs are allowed. When determining the client's source IP, the code...
Vaultwarden icon endpoint SSRF via IP-literal hrefs
Vaultwarden icon Endpoint Server-Side Request Forgery SSRF Vulnerability Overview Vaultwarden's built-in icon service ICONSERVICE=internal automatically fetches, on the server side, the web pages and icon resources pointed to by vault entry URIs in order to display favicons for entries. The...
OpenBSD: undisclosed vulnerability (ZAI-2026-3DFRID)
Not disclosed. Details are not yet publicly disclosed...
BIND9: undisclosed vulnerability (ZAI-2026-O7DVD0)
Not disclosed. Details are not yet publicly disclosed...
Portainer Edge Agent endpoints do not validate EdgeStack assignment, allowing unauthorized reads of unassigned stack files and forged status reports
Portainer Edge Agent Endpoint EdgeStack Assignment Authorization Bypass Vulnerability Overview Two categories of Portainer Server endpoints serving Edge Agents -- Edge Stack deployment-file retrieval and deployment status reporting -- resolve the reporting environment from the Edge ID in the...
Linux kernel nft_inner: IPv6 inner_thoff desynchronization causes firewall bypass
Linux kernel nftinner: IPv6 innerthoff desynchronization causes firewall bypass Vulnerability Overview In the Linux kernel netfilter nftables inner expression, when parsing an inner IPv6 packet, ipv6findhdr first correctly computes the transport-layer offset including extension headers, but the...
GStreamer: undisclosed vulnerability (ZAI-2026-OT5LA4)
Not disclosed. Details are not yet publicly disclosed...
FineReport: undisclosed vulnerability (ZAI-2026-LMZN40)
Not disclosed. Details are not yet publicly disclosed...
Dnsmasq: undisclosed vulnerability (ZAI-2026-ORY50V)
Not disclosed. Details are not yet publicly disclosed...
Airbnb: undisclosed vulnerability (ZAI-2026-PX2F0W)
Not disclosed. Details are not yet publicly disclosed...