2436 matches found
RAR: undisclosed vulnerability (ZAI-2026-JZBOI7)
Not disclosed. Details are not yet publicly disclosed...
RAR: undisclosed vulnerability (ZAI-2026-3U0TLP)
Not disclosed. Details are not yet publicly disclosed...
Oracle Real Application Clusters DB Home: undisclosed vulnerability (ZAI-2026-RB5JNF)
Not disclosed. Details are not yet publicly disclosed...
Oracle Real Application Clusters DB Home: undisclosed vulnerability (ZAI-2026-0F6DHD)
Not disclosed. Details are not yet publicly disclosed...
Microsoft Word: undisclosed vulnerability (ZAI-2026-8LQ0YC)
Not disclosed. Details are not yet publicly disclosed...
Microsoft OneDrive: undisclosed vulnerability (ZAI-2026-RYSL0V)
Not disclosed. Details are not yet publicly disclosed...
Microsoft Edge: undisclosed vulnerability (ZAI-2026-0PQAVI)
Not disclosed. Details are not yet publicly disclosed...
Intel Integrated Performance Primitives: undisclosed vulnerability (ZAI-2026-RXPGNQ)
Not disclosed. Details are not yet publicly disclosed...
FortiClient: undisclosed vulnerability (ZAI-2026-20I2HV)
Not disclosed. Details are not yet publicly disclosed...
FortiClient: undisclosed vulnerability (ZAI-2026-IQVLTY)
Not disclosed. Details are not yet publicly disclosed...
Cisco Webex: undisclosed vulnerability (ZAI-2026-W123T1)
Not disclosed. Details are not yet publicly disclosed...
FineReport: undisclosed vulnerability (ZAI-2026-PEQ0L2)
Not disclosed. Details are not yet publicly disclosed...
JeecgBoot: undisclosed vulnerability (ZAI-2026-VGSCLJ)
Not disclosed. Details are not yet publicly disclosed...
FanDuel: undisclosed vulnerability (ZAI-2026-L4WLPF)
Not disclosed. Details are not yet publicly disclosed...
Lightspark: undisclosed vulnerability (ZAI-2026-DO9EZR)
Not disclosed. Details are not yet publicly disclosed...
FreeBSD: undisclosed vulnerability (ZAI-2026-20E58R)
Not disclosed. Details are not yet publicly disclosed...
Shopify: undisclosed vulnerability (ZAI-2026-HN6HI6)
Not disclosed. Details are not yet publicly disclosed...
Google Chrome: undisclosed vulnerability (ZAI-2026-T61T5D)
Not disclosed. Details are not yet publicly disclosed...
FineReport: undisclosed vulnerability (ZAI-2026-MEE4WO)
Not disclosed. Details are not yet publicly disclosed...
Kubernetes: undisclosed vulnerability (ZAI-2026-MAQYV3)
Not disclosed. Details are not yet publicly disclosed...
23andMe: undisclosed vulnerability (ZAI-2026-JP1ICF)
Not disclosed. Details are not yet publicly disclosed...
ALSCO: undisclosed vulnerability (ZAI-2026-CO3E9J)
Not disclosed. Details are not yet publicly disclosed...
Coupang Taiwan: undisclosed vulnerability (ZAI-2026-84R83M)
Not disclosed. Details are not yet publicly disclosed...
Bumble: undisclosed vulnerability (ZAI-2026-VWWTZ1)
Not disclosed. Details are not yet publicly disclosed...
S-Pankki: undisclosed vulnerability (ZAI-2026-GXXXJN)
Not disclosed. Details are not yet publicly disclosed...
FreeBSD: undisclosed vulnerability (ZAI-2026-558JUC)
Not disclosed. Details are not yet publicly disclosed...
Vercel: undisclosed vulnerability (ZAI-2026-E7YDZ7)
Not disclosed. Details are not yet publicly disclosed...
Frappe Discussion Reply Markdown rendering allows unsafe tags, leading to stored XSS
Frappe Discussion Reply Markdown Rendering Allows Unsafe Tags, Leading to Stored XSS Vulnerability Overview The Discussion feature on the website side of Frappe Framework supports Markdown replies; after a reply is saved, the system pushes the rendered Markdown result in real time to all online...
DokuWiki authplain modifyUser regex injection can delete other users' accounts
DokuWiki authplain modifyUser regex injection can delete other users' accounts Vulnerability Overview When DokuWiki uses the built-in authplain authentication backend, user profiles are stored in the users.auth.php file, and the modifyUser operation triggered by a user updating their profile...
NocoDB leaks other creators' private integration configuration when includeConfig is omitted
NocoDB Private Integration Configuration Information Disclosure Vulnerability Overview NocoDB's workspace-level Base Integration read service has an authorization logic flaw in its handling of the includeConfig request parameter: the check that "a private integration's configuration is visible on...
WeKan Trello import source.url stored XSS can steal Meteor.loginToken (SourceBleed)
WeKan Trello Import source.url Stored XSS Can Steal Session Tokens SourceBleed Vulnerability Overview When WeKan imports a Trello board, it persists the import source information including the source board's URL and renders it as a clickable link in the board's activity sidebar, without validatin...
VMware Workstation/Fusion NAT vulnerability: a guest VM admin can disrupt or intercept other guest VMs' network connections
VMware Workstation/Fusion NAT Network Packet Management Flaw Allows a Guest VM to Disrupt or Intercept Other Guest VMs' Network Connections CVE-2026-22715 Vulnerability Overview VMware Workstation and Fusion contain a logic flaw CWE-923, communication channel not correctly restricted to intended...
Apache Superset CTAS tmp_table_name SQL injection bypasses the allow_dml restriction
Apache Superset CTAS tmptablename SQL Injection Bypasses the allowdml Database Security Restriction ZAI-2026-IIRAQ1 Vulnerability Overview In Apache Superset's SQL Lab "save query result as table" CTAS/CVAS feature, the tmptablename parameter used to specify the target table name is neither...
GStreamer librfb: rfb_decoder_fill_rectangle() wrong write granularity causes heap out-of-bounds write
GStreamer librfb: rfbdecoderfillrectangle wrong write granularity causes heap out-of-bounds write Vulnerability Overview In rfbsrc the VNC/RFB client element of GStreamer gst-plugins-bad, rfbdecoderfillrectangle fills rectangles by writing pixels at guint32 4-byte granularity regardless of the...
GStreamer webrtcbin: inverted SDP fingerprint presence check enables remote SDP authentication-binding bypass
GStreamer webrtcbin: inverted SDP fingerprint presence check enables remote SDP authentication-binding bypass Vulnerability Overview While validating a remote SDP in the set-remote-description path, GStreamer webrtcbin's checksdpcrypto inverts the presence check for a=fingerprint attributes: an S...
Linux kernel 6LoWPAN: off-by-one in multicast context address compression leaks a stack byte
Linux kernel 6LoWPAN: off-by-one in multicast context address compression leaks a stack byte Vulnerability Overview The Linux kernel 6LoWPAN IPHC multicast context address compression path contains an off-by-one error and uses a wrong memcpy offset, corrupting the RIID field of compressed multica...
[FreeBSD] ptrace PT_SC_REMOTE missing argument validation: 32GiB memmove underflow + sysent out-of-bounds call
Summary A local unprivileged user can trigger a 32GiB memmove underflow via ptrace PTSCREMOTE with pscrnargs=0, and call arbitrary sysent function pointers due to missing syscall number bounds check in ptracesyscallreq. This allows kernel code execution under security.bsd.unprivilegedprocdebug=1...
memcached: undisclosed vulnerability (ZAI-2026-D9HSWV)
Not disclosed. Details are not yet publicly disclosed...
Tencent Enterprise Mail: undisclosed vulnerability (ZAI-2026-523FHO)
Not disclosed. Details are not yet publicly disclosed...
Dnsmasq: undisclosed vulnerability (ZAI-2026-WZ4HG0)
Not disclosed. Details are not yet publicly disclosed...
Knot DNS: undisclosed vulnerability (ZAI-2026-QGDPT5)
Not disclosed. Details are not yet publicly disclosed...
Technitium DNS: undisclosed vulnerability (ZAI-2026-U6J3O8)
Not disclosed. Details are not yet publicly disclosed...
glibc resolver: undisclosed vulnerability (ZAI-2026-KDCNDB)
Not disclosed. Details are not yet publicly disclosed...
126 Mail: undisclosed vulnerability (ZAI-2026-6NPKQY)
Not disclosed. Details are not yet publicly disclosed...
Microsoft Edge: undisclosed vulnerability (ZAI-2026-CSE9HW)
Not disclosed. Details are not yet publicly disclosed...
GStreamer: undisclosed vulnerability (ZAI-2026-UDE17Z)
Not disclosed. Details are not yet publicly disclosed...
GStreamer: undisclosed vulnerability (ZAI-2026-PXFW9O)
Not disclosed. Details are not yet publicly disclosed...
Vercel: undisclosed vulnerability (ZAI-2026-EXNPFK)
Not disclosed. Details are not yet publicly disclosed...