2436 matches found
Wechat: undisclosed vulnerability (ZAI-2026-KJNQEL)
Not disclosed. Details are not yet publicly disclosed...
Frappe list filter values rendered unescaped, leading to XSS
Frappe List Filter Values Rendered Unescaped, Leading to XSS Vulnerability Overview When rendering the search/filter template of the website-side list view in Frappe Framework, the search keywords from the query string and the page path are embedded directly into the HTML output, with key positio...
DokuWiki Revert plugin renders changelog usernames unescaped, leading to stored XSS
DokuWiki Revert plugin renders changelog usernames unescaped, leading to stored XSS Vulnerability Overview DokuWiki's built-in revert admin plugin, when listing changelog edit records, HTML-escapes edit summaries but outputs the changelog user field verbatim. For authentication backends that do n...
Seafile out-of-bounds read on malformed head commit ID
Seafile out-of-bounds read on malformed head commit ID Vulnerability Overview When the Seafile client daemon checks the remote head commit, it parses the head commit ID from the server response and copies it into the destination buffer at a fixed length 40 bytes; Seafile commit IDs are 40...
Portainer Edge Agent endpoints do not validate EdgeStack assignment, allowing unauthorized reads of unassigned stack files and forged status reports
Portainer Edge Agent Endpoint EdgeStack Assignment Authorization Bypass Vulnerability Overview Two categories of Portainer Server endpoints serving Edge Agents -- Edge Stack deployment-file retrieval and deployment status reporting -- resolve the reporting environment from the Edge ID in the...
WeKan CAS login shares module-level global user data, enabling concurrent account takeover (CasBleed)
WeKan CAS Login Shares Module-Level Global User Data, Enabling Concurrent Account Takeover CasBleed Vulnerability Overview WeKan's CAS single sign-on implementation contains a concurrent race condition flaw: the user identity data returned by the CAS server after ticket validation is stored in a...
Vaultwarden unconditionally trusts the X-Real-IP header, enabling rate-limit bypass and audit IP spoofing
Vaultwarden Unconditional Trust in the X-Real-IP Request Header Leading to Rate-Limit Bypass and Audit IP Spoofing Overview Vaultwarden supports reading the client IP from a configurable HTTP request header IPHEADER, default X-Real-IP for rate limiting of login/2FA and the admin panel, as well as...
Vaultwarden icon endpoint SSRF via IP-literal hrefs
Vaultwarden icon Endpoint Server-Side Request Forgery SSRF Vulnerability Overview Vaultwarden's built-in icon service ICONSERVICE=internal automatically fetches, on the server side, the web pages and icon resources pointed to by vault entry URIs in order to display favicons for entries. The...
Linux kernel 6LoWPAN: off-by-one in multicast context address compression leaks a stack byte
Linux kernel 6LoWPAN: off-by-one in multicast context address compression leaks a stack byte Vulnerability Overview The Linux kernel 6LoWPAN IPHC multicast context address compression path contains an off-by-one error and uses a wrong memcpy offset, corrupting the RIID field of compressed multica...
SMTP MIME message/rfc822: encapsulation parser state not reset, bypassing attachment filename and decoded-content inspection
SMTP MIME message/rfc822: encapsulation parser state not reset, bypassing attachment filename and decoded-content inspection Vulnerability Overview Suricata's SMTP MIME parser incompletely resets state when processing message/rfc822 encapsulated messages: after entering the inner message, the...
Linux kernel FDDI: short frames parsed before header length validation cause out-of-bounds read
Linux kernel FDDI: short frames parsed before header length validation cause out-of-bounds read Vulnerability Overview The Linux kernel FDDI receive path parses FDDI/LLC/SNAP header fields before verifying that the skb contains enough bytes, so malformed short frames can trigger an out-of-bounds...
GStreamer: undisclosed vulnerability (ZAI-2026-SCU2XI)
Not disclosed. Details are not yet publicly disclosed...
GStreamer: undisclosed vulnerability (ZAI-2026-GHD13E)
Not disclosed. Details are not yet publicly disclosed...
Redis: undisclosed vulnerability (ZAI-2026-DFUWR5)
Not disclosed. Details are not yet publicly disclosed...
Suricata: undisclosed vulnerability (ZAI-2026-P6W4QC)
Not disclosed. Details are not yet publicly disclosed...
lwIP: undisclosed vulnerability (ZAI-2026-5DYARX)
Not disclosed. Details are not yet publicly disclosed...
wget2: undisclosed vulnerability (ZAI-2026-O1DXP4)
Not disclosed. Details are not yet publicly disclosed...
Redis: undisclosed vulnerability (ZAI-2026-90R0WI)
Not disclosed. Details are not yet publicly disclosed...
Suricata: undisclosed vulnerability (ZAI-2026-7EFG4W)
Not disclosed. Details are not yet publicly disclosed...
RT-Thread: undisclosed vulnerability (ZAI-2026-JXBWGU)
Not disclosed. Details are not yet publicly disclosed...
FFmpeg: undisclosed vulnerability (ZAI-2026-8OCKNA)
Not disclosed. Details are not yet publicly disclosed...
Unbound: undisclosed vulnerability (ZAI-2026-HD7NUF)
Not disclosed. Details are not yet publicly disclosed...
Redis: undisclosed vulnerability (ZAI-2026-MQTBX0)
Not disclosed. Details are not yet publicly disclosed...
wolfSSL: undisclosed vulnerability (ZAI-2026-ZFYTAI)
Not disclosed. Details are not yet publicly disclosed...
lwIP: undisclosed vulnerability (ZAI-2026-SLN59I)
Not disclosed. Details are not yet publicly disclosed...
GStreamer: undisclosed vulnerability (ZAI-2026-88ITBX)
Not disclosed. Details are not yet publicly disclosed...
Redis: undisclosed vulnerability (ZAI-2026-ZS9LKQ)
Not disclosed. Details are not yet publicly disclosed...
wolfSSL: undisclosed vulnerability (ZAI-2026-CMMW1U)
Not disclosed. Details are not yet publicly disclosed...
RT-Thread: undisclosed vulnerability (ZAI-2026-DLOLC8)
Not disclosed. Details are not yet publicly disclosed...
Redis: undisclosed vulnerability (ZAI-2026-PL47T8)
Not disclosed. Details are not yet publicly disclosed...
GStreamer: undisclosed vulnerability (ZAI-2026-AEYTDF)
Not disclosed. Details are not yet publicly disclosed...
FFmpeg: undisclosed vulnerability (ZAI-2026-AR9H5A)
Not disclosed. Details are not yet publicly disclosed...
GStreamer: undisclosed vulnerability (ZAI-2026-GQL49R)
Not disclosed. Details are not yet publicly disclosed...
OpenVPN: undisclosed vulnerability (ZAI-2026-05I5H2)
Not disclosed. Details are not yet publicly disclosed...
libevent: undisclosed vulnerability (ZAI-2026-69JPUA)
Not disclosed. Details are not yet publicly disclosed...
GStreamer: undisclosed vulnerability (ZAI-2026-ZISLGH)
Not disclosed. Details are not yet publicly disclosed...
wolfSSL: undisclosed vulnerability (ZAI-2026-2GK04J)
Not disclosed. Details are not yet publicly disclosed...
MaraDNS: undisclosed vulnerability (ZAI-2026-0CJ0FC)
Not disclosed. Details are not yet publicly disclosed...
Redis: undisclosed vulnerability (ZAI-2026-WMAG89)
Not disclosed. Details are not yet publicly disclosed...
Redis: undisclosed vulnerability (ZAI-2026-ZDH6F9)
Not disclosed. Details are not yet publicly disclosed...
Redis: undisclosed vulnerability (ZAI-2026-C5036K)
Not disclosed. Details are not yet publicly disclosed...
llama.cpp: undisclosed vulnerability (ZAI-2026-HULB55)
Not disclosed. Details are not yet publicly disclosed...
Yahoo Mail: undisclosed vulnerability (ZAI-2026-9I8QZX)
Not disclosed. Details are not yet publicly disclosed...
FFmpeg: undisclosed vulnerability (ZAI-2026-S0TOET)
Not disclosed. Details are not yet publicly disclosed...
OpenBSD: undisclosed vulnerability (ZAI-2026-2HATYU)
Not disclosed. Details are not yet publicly disclosed...
Wechat: undisclosed vulnerability (ZAI-2026-L4Q91F)
Not disclosed. Details are not yet publicly disclosed...
JeecgBoot: undisclosed vulnerability (ZAI-2026-OZU60C)
Not disclosed. Details are not yet publicly disclosed...
Dingtalk: undisclosed vulnerability (ZAI-2026-2PJVT2)
Not disclosed. Details are not yet publicly disclosed...