2436 matches found
Redis: undisclosed vulnerability (ZAI-2026-LNZGNG)
Not disclosed. Details are not yet publicly disclosed...
Chasquid: undisclosed vulnerability (ZAI-2026-7Y6YOD)
Not disclosed. Details are not yet publicly disclosed...
Redis: undisclosed vulnerability (ZAI-2026-VLANCP)
Not disclosed. Details are not yet publicly disclosed...
Redis: undisclosed vulnerability (ZAI-2026-1Q6UU5)
Not disclosed. Details are not yet publicly disclosed...
Pixiv: undisclosed vulnerability (ZAI-2026-G2X87A)
Not disclosed. Details are not yet publicly disclosed...
JeecgBoot: undisclosed vulnerability (ZAI-2026-P75QQS)
Not disclosed. Details are not yet publicly disclosed...
GStreamer: undisclosed vulnerability (ZAI-2026-138GI8)
Not disclosed. Details are not yet publicly disclosed...
Nacos: undisclosed vulnerability (ZAI-2026-3076EK)
Not disclosed. Details are not yet publicly disclosed...
wolfSSL: undisclosed vulnerability (ZAI-2026-T3I9LK)
Not disclosed. Details are not yet publicly disclosed...
bank-dispute: undisclosed vulnerability (ZAI-2026-41WNIX)
Not disclosed. Details are not yet publicly disclosed...
Apple Safari: undisclosed vulnerability (ZAI-2026-BVBFCK)
Not disclosed. Details are not yet publicly disclosed...
126 Mail: undisclosed vulnerability (ZAI-2026-6NPKQY)
Not disclosed. Details are not yet publicly disclosed...
FineReport: undisclosed vulnerability (ZAI-2026-PEQ0L2)
Not disclosed. Details are not yet publicly disclosed...
Frappe comment template context values unescaped, leading to XSS
Frappe Comment Template Context Values Unescaped, Leading to XSS Vulnerability Overview When rendering the Jinja template of the website-side comment component in Frappe Framework, context values such as the page path, referenced doctype, and document name are concatenated directly into HTML...
FFmpeg: undisclosed vulnerability (ZAI-2026-D9L696)
Not disclosed. Details are not yet publicly disclosed...
GStreamer: undisclosed vulnerability (ZAI-2026-URWEH2)
Not disclosed. Details are not yet publicly disclosed...
Dingtalk: undisclosed vulnerability (ZAI-2026-2PJVT2)
Not disclosed. Details are not yet publicly disclosed...
Vaultwarden /events/collect cross-organization event injection
Vaultwarden /events/collect Cross-Organization Event Injection Vulnerability Overview The Bitwarden protocol's event-reporting endpoint POST /events/collect receives user operation events submitted by clients entry viewing, password-field copying, editing, etc., and the server writes them into...
SmartDNS: undisclosed vulnerability (ZAI-2026-81HOU3)
Not disclosed. Details are not yet publicly disclosed...
Exim: undisclosed vulnerability (ZAI-2026-1O9YNW)
Not disclosed. Details are not yet publicly disclosed...
FreeBSD: undisclosed vulnerability (ZAI-2026-1RHT80)
Not disclosed. Details are not yet publicly disclosed...
inDrive: undisclosed vulnerability (ZAI-2026-4TYTBA)
Not disclosed. Details are not yet publicly disclosed...
Microsoft DNS: undisclosed vulnerability (ZAI-2026-Z2AF14)
Not disclosed. Details are not yet publicly disclosed...
Typora: undisclosed vulnerability (ZAI-2026-50LRC9)
Not disclosed. Details are not yet publicly disclosed...
Redis: undisclosed vulnerability (ZAI-2026-UHBN8E)
Not disclosed. Details are not yet publicly disclosed...
QQ Mail: undisclosed vulnerability (ZAI-2026-2FWFM1)
Not disclosed. Details are not yet publicly disclosed...
VMware Workstation/Fusion NAT vulnerability: a guest VM admin can disrupt or intercept other guest VMs' network connections
VMware Workstation/Fusion NAT Network Packet Management Flaw Allows a Guest VM to Disrupt or Intercept Other Guest VMs' Network Connections CVE-2026-22715 Vulnerability Overview VMware Workstation and Fusion contain a logic flaw CWE-923, communication channel not correctly restricted to intended...
Linux kernel 6lowpan: NHC entry use-after-free on error path
In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpannhcdouncompression looks up an NHC descriptor while holding lowpannhclock. If the descriptor has no uncompress callback, the error path drops the lock before printing...
Databricks: undisclosed vulnerability (ZAI-2026-BVF26F)
Not disclosed. Details are not yet publicly disclosed...
TikTok: undisclosed vulnerability (ZAI-2026-3XMTX2)
Not disclosed. Details are not yet publicly disclosed...
Suricata: undisclosed vulnerability (ZAI-2026-SSNI71)
Not disclosed. Details are not yet publicly disclosed...
wolfSSL: undisclosed vulnerability (ZAI-2026-R0NL2I)
Not disclosed. Details are not yet publicly disclosed...
Frappe Discussion Reply Markdown rendering allows unsafe tags, leading to stored XSS
Frappe Discussion Reply Markdown Rendering Allows Unsafe Tags, Leading to Stored XSS Vulnerability Overview The Discussion feature on the website side of Frappe Framework supports Markdown replies; after a reply is saved, the system pushes the rendered Markdown result in real time to all online...
SMTP MIME message/rfc822: encapsulation parser state not reset, bypassing attachment filename and decoded-content inspection
SMTP MIME message/rfc822: encapsulation parser state not reset, bypassing attachment filename and decoded-content inspection Vulnerability Overview Suricata's SMTP MIME parser incompletely resets state when processing message/rfc822 encapsulated messages: after entering the inner message, the...
Frappe Auto Repeat update_reference lacks reference-document permission check, allowing unauthorized document references
Frappe Auto Repeat updatereference Lacks Reference-Document Permission Check, Allowing Unauthorized Document References Vulnerability Overview Auto Repeat in Frappe Framework automatic repetition / subscription documents provides a whitelisted method used to bind a reference document to an...
WeKan /metrics unconditionally trusts X-Forwarded-For, allowing whitelist IP spoofing (MetricsBleed)
WeKan /metrics Unconditionally Trusts X-Forwarded-For, Allowing Whitelist IP Spoofing MetricsBleed Vulnerability Overview WeKan's Prometheus /metrics endpoint restricts access via an IP whitelist only configured monitoring IPs are allowed. When determining the client's source IP, the code...
FineReport: undisclosed vulnerability (ZAI-2026-LMZN40)
Not disclosed. Details are not yet publicly disclosed...
glibc resolver: undisclosed vulnerability (ZAI-2026-TJS14X)
Not disclosed. Details are not yet publicly disclosed...
ALSCO: undisclosed vulnerability (ZAI-2026-3XCY8S)
Not disclosed. Details are not yet publicly disclosed...
Portainer Edge Agent endpoints do not validate EdgeStack assignment, allowing unauthorized reads of unassigned stack files and forged status reports
Portainer Edge Agent Endpoint EdgeStack Assignment Authorization Bypass Vulnerability Overview Two categories of Portainer Server endpoints serving Edge Agents -- Edge Stack deployment-file retrieval and deployment status reporting -- resolve the reporting environment from the Edge ID in the...
OpenBSD: undisclosed vulnerability (ZAI-2026-3DFRID)
Not disclosed. Details are not yet publicly disclosed...
Frappe Connected App OAuth flow: insufficient permission checks and external redirect
Frappe Connected App OAuth Flow: Insufficient Permission Checks and External Redirect Vulnerability Overview Connected App in Frappe Framework is an OAuth2 client integration mechanism; its whitelisted method is used to generate an authorization URL for a user and write the authorization state in...
Vaultwarden icon endpoint SSRF via IP-literal hrefs
Vaultwarden icon Endpoint Server-Side Request Forgery SSRF Vulnerability Overview Vaultwarden's built-in icon service ICONSERVICE=internal automatically fetches, on the server side, the web pages and icon resources pointed to by vault entry URIs in order to display favicons for entries. The...
GStreamer: undisclosed vulnerability (ZAI-2026-458UTH)
Not disclosed. Details are not yet publicly disclosed...
Airbnb: undisclosed vulnerability (ZAI-2026-PX2F0W)
Not disclosed. Details are not yet publicly disclosed...
Dnsmasq: undisclosed vulnerability (ZAI-2026-ORY50V)
Not disclosed. Details are not yet publicly disclosed...
GStreamer: undisclosed vulnerability (ZAI-2026-OT5LA4)
Not disclosed. Details are not yet publicly disclosed...
BIND9: undisclosed vulnerability (ZAI-2026-O7DVD0)
Not disclosed. Details are not yet publicly disclosed...
Frappe Google OAuth state is client-controllable, enabling redirects and authorization-flow abuse
Frappe Google OAuth State Is Client-Controllable, Enabling Redirects and Authorization-Flow Abuse Vulnerability Overview The Google integrations in Frappe Framework Gmail/Calendar/Drive, etc. share a unified OAuth authorization entry point and callback handler. Before the fix, the authorization...
Frappe Web Form script context values rendered unescaped, leading to XSS
Frappe Web Form Script Context Values Rendered Unescaped, Leading to Stored XSS Vulnerability Overview Web Form in Frappe Framework website forms is a data-submission entry point for anonymous/external users; its page template serializes the server-side document object and injects it into a globa...