378256 matches found
CVE-2024-58330
CVE-2024-58330 affects Bosch IP cameras families CPP13 and CPP14 due to a missing authentication check in the access path that guards video analytics event data. The vulnerability enables an unauthenticated attacker to retrieve video analytics event data remotely over the network, with a CVSS v3....
CVE-2024-58023
Technical details are not publicly available in the provided documents. Monitor Bosch security advisories for updates on CVE-2024-58023.
CVE-2026-52684
The CVE-2026-52684 entry describes a vulnerability in the Prefetch feature that can enable a persistent ghost domain cache poisoning attack. Affected scenario occurs when the auth response is very slow and records expire between fetches; TTL capping is not enforced due to lack of data, unlike reg...
CVE-2026-16287
CVE-2026-16287 affects Pardus-update (TÜBİTAK BİLGEM) with OS command injection via offline update. Affected: pardus-update versions before 0.7.0 (starting at 0.6.6). Root cause: improper neutralization of special OS command elements. Impact: high for confidentiality, integrity, and availability;...
CVE-2026-9713
CVE-2026-9713 : The Lumise Product Designer for WooCommerce WordPress plugin (up to version 2.1.1) is vulnerable to SQL injection via the uploaded cart JSON file processed by the checkout AJAX action. The root cause is insufficient escaping of user-provided parameters in the find_resource() funct...
CVE-2026-9635
The CVE concerns the WP Shortcode by MyThemeShop plugin for WordPress. A stored XSS exists in the [tab] shortcode via the 'title' attribute in versions up to 1.4.17. The root cause is insufficient input sanitization and output escaping in the mts_tabs() function, which directly echoes the title a...
CVE-2026-9729
The CVE-2026-9729 entry concerns the Webpushr Push Notifications plugin for WordPress (versions up to 4.39.0). It describes a Stored Cross-Site Scripting flaw in which unsanitized input from the webpushr_notification_title and webpushr_notification_body parameters is combined into HTML attribute ...
CVE-2026-12421
The ARforms WordPress plugin (affected: all versions up to and including 7.2.1) is vulnerable to Stored Cross-Site Scripting via password field values due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages that ...
CVE-2026-59678
CVE-2026-59678 : An reported Incorrect Authorization vulnerability in Linux-Gaming PortProtonQt allows any user to mount/unmount arbitrary file systems and modify network settings via NetworkManager. Affected: PortProtonQt before 0d0f0950ebd948cdf82e8c3e1ebd2bcb9b8bafbe. Impact includes local pri...
CVE-2026-59677
The CVE-2026-59677 issue is a local vulnerability in SELinux policycoreutils seunshares (up to version 3.10) that permits a user running in an unconfined context to kill root-owned processes also in unconfined context. Documented under PT-2026-61060 as a Local DoS/vector in seunshare, with the af...
CVE-2026-59676
This CVE concerns a TOCTOU race in the seunshare utility of policycoreutils (up to version 3.10) that lets a user in the unconfined SELinux domain delete arbitrary root-owned files. Affected component: seunshare within policycoreutils; root cause: TOCTOU race enabling local file deletion via rm_r...
CVE-2026-9066
The CVE describes a Reflected XSS in WP Compress for WordPress plugin before 7.10.04 due to lack of validation of a query parameter that controls the asset CDN host. This allows an attacker, via a crafted link, to cause the loader to inject script elements pointing to an attacker-controlled origi...
CVE-2026-9577
The Post Status Notifier Lite WordPress plugin (before 1.13.0) is affected. The vulnerability arises because the plugin does not properly escape the mod URL parameter before reflecting it into the admin settings page (admin.php?page=post-status-notifier-lite), enabling a Reflected Cross-Site Scri...
CVE-2026-14291
The CVE-2026-14291 entry concerns the security-ninja-premium WordPress plugin (before 5.290). The issue is that one of the two-factor authentication (2FA) code paths does not verify the second factor, enabling an unauthenticated attacker who knows a user’s password to complete authentication with...
CVE-2026-12082
CVE-2026-12082 affects the Praison AI SEO WordPress plugin prior to version 5.0.7. The root cause is missing authorization checks on several REST API routes, allowing unauthenticated users to: (1) modify the permalink of any published post and (2) read the plugin’s configuration data from before ...
CVE-2026-64600
The CVE-2026-64600 issue affects the Linux kernel’s XFS implementation. The race arises when xfs_reflink_fill_{cow_hole,delalloc} cycle the ILOCK to obtain a transaction, leaving data fork and cow fork mappings stale after reacquiring the ILOCK. Specifically, the data fork mapping was not refresh...
CVE-2026-7232
The CVE-2026-7232 entry describes a Stored XSS in the WordPress FormCraft plugin (all versions up to 3.9.14). Root cause: insufficient input sanitization and output escaping, with a server-side gap where matrix sub-field keys like field2_0/field2_1 bypass the sanitization loop and are stored via ...
CVE-2026-7534
The CVE-2026-7534 entry details a vulnerability in the SUMO Reward Points for WooCommerce plugin (WordPress) up to version 32.7.0. Affected component: SRP_REST_Earning_Controller handling REST endpoint /wp-json/wc-srp/v1/earning. Root cause: the user_has_cap filter unconditionally grants the rs_e...
CVE-2026-63226
CVE-2026-63226 affects Ricoh Printers and MFPs. The issue is lack of restrictions on SSH port forwarding, enabling SSH port forwarding to reach arbitrary destinations on the LAN when SSH is enabled on the affected product. The connected documents provide the vulnerability description and CVSS met...
CVE-2026-6390
CVE-2026-6390 affects GNU nano. The issue is a format string vulnerability in multi-buffer error handling: when opening multiple files at startup, a filename containing printf format specifiers can be reinterpreted, potentially enabling stack information disclosure, a crash (DoS), or arbitrary me...
CVE-2026-15074
The CVE-2026-15074 issue affects @fastify/static up to and including version 10.1.0, which fails to reject dot-dot path segments in request pathnames before file resolution. This bypasses the earlier fix for CVE-2026-6414 (encoded slashes only) because the underlying send library normalizes dot s...
CVE-2026-7120
The CVE-2026-7120 issue affects @fastify/static (versions up to and including 10.1.1). The root cause is that allowedPath is evaluated before normalizing dot segments and duplicate separators in the request pathname, allowing an unauthenticated attacker to bypass path-based filtering by using equ...
CVE-2026-21723
CVE-2026-21723 affects Grafana, specifically the alertmanager templates test endpoint at /api/alertmanager/grafana/config/api/v1/templates/test. The endpoint can execute templates with no memory limits, and mass execution in a short time can cause out-of-memory (OOM) and crash the Grafana service...
CVE-2026-16653
CVE-2026-16653 concerns boazsegev facil.io up to version 0.7.58. The vulnerability affects the Public Folder Handler, specifically the http_sendfile2 function in lib/facil/http/http.c, where manipulation allows path traversal. Remote exploitation is possible and the exploit has been released publ...
CVE-2026-29988
Technical details are not publicly available in the provided documents for CVE-2026-29988; monitor for updates.
CVE-2026-52687
Technical details are not publicly available in the provided documents; monitor for updates.
CVE-2026-91204
Technical details for CVE-2026-91204 are not publicly available in the provided documents. Monitor for updates.
CVE-2026-39155
Knot DNS before 3.4.10 and 3.5.x before 3.5.4 contain a vulnerability in mod-onlinesign where the next NSEC owner name can be computed incorrectly, creating an overly broad authenticated denial interval. This enables downstream validating resolvers using aggressive negative caching to synthesize ...
CVE-2026-38764
Protegent 360 v2.0.0.4 from Unistal Systems Pvt. Ltd. contains a local privilege escalation vulnerability in the kernel driver pgsecdl.sys (CVE-2026-38764). The issue enables a low-privilege local attacker to escalate to SYSTEM, with a CVSS v3.1 base score of 7.8 (High): Local, Low privileges req...
CVE-2026-52439
Affected software: xiandafu beetl 3.20.2. The vulnerability arises from the type.new function combined with the property reflection mechanism, allowing a remote attacker to execute arbitrary code. The impact is remote code execution with high severity (as per CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H...
CVE-2026-16632
CVE-2026-16632 affects boazsegev facil.io up to 0.7.4, specifically the WebSocket Frame Parser component. The vulnerability is in websocket_on_protocol_error (library file lib/facil/http/parsers/websocket_parser.h) where manipulation of the on_message argument leads to improper input validation. ...
CVE-2026-16631
The CVE-2026-16631 entry concerns publint up to version 0.1.4 where the pack.js file in the package-manager Command Handler uses child_process.exec, enabling os command injection. Local attack required; exploit is public. A patch identified as adf2d9a09945fc98c85a2520a89f441d78b2dbd8 exists and s...
CVE-2026-10050
Summary: The GitHub advisory for Eclipse Jetty Digest Authentication documents a root-cause in DigestAuthentication.apply() that uses ISO-8859-1 to compute H(A1), H(A2), and H(A3). Characters outside U+00FF are silently replaced with 0x3F, causing identical MD5-based Digest responses for distinct...
CVE-2026-61246
CVE-2026-61246 affects Oracle Platform Security for Java (Oracle Fusion Middleware) - Centralized Thirdparty Jars. The vulnerability is exploitable over HTTP by a low-privileged attacker with network access and can lead to takeover of Oracle Platform Security for Java. Affected versions are 12.2....
CVE-2026-60439
CVE-2026-60439 affects the Oracle Platform Security for Java component “Centralized Thirdparty Jars” in Oracle Fusion Middleware. Affected versions are 12.2.1.4.0 and 14.1.2.0.0. The description specifies that a low-privilege, network-reachable attacker (via HTTP) can compromise Oracle Platform S...
CVE-2026-60455
The CVE-2026-60455 affects Oracle Platform Security for Java (Oracle Fusion Middleware), specifically the Centralized Thirdparty Jars component. Affected supported versions are 12.2.1.4.0 and 14.1.2.0.0. The vulnerability is exploitable by a low-privilege attacker with network access via HTTP, po...
CVE-2026-60372
CVE-2026-60372 concerns the Oracle Platform Security for Java component of Oracle Fusion Middleware, specifically the Centralized Thirdparty Jars. Affects supported versions 12.2.1.4.0 and 14.1.2.0.0. The vulnerability allows an unauthenticated attacker with network access over HTTP to compromise...
CVE-2026-60371
CVE-2026-60371 affects Oracle Platform Security for Java (Fusion Middleware), specifically the Centralized Thirdparty Jars component. Affected versions are 12.2.1.4.0 and 14.1.2.0.0. The issue is described as difficult to exploit, requiring low privileges and access to the hardware’s physical com...
CVE-2026-60373
The CVE-2026-60373 entry concerns Oracle Platform Security for Java (Oracle Fusion Middleware) with the affected component Centralized Thirdparty Jars. Affected versions are 12.2.1.4.0 and 14.1.2.0.0. The vulnerability allows a low-privileged attacker who can reach the system over HTTP to comprom...
CVE-2026-60368
Technical details for CVE-2026-60368 are not publicly available in the provided documents. Monitor for updates from Oracle and CVE listings.
CVE-2026-60370
CVE-2026-60370 affects Oracle Platform Security for Java (Oracle Fusion Middleware), specifically the Centralized Thirdparty Jars component. Affected versions are 12.2.1.4.0 and 14.1.2.0.0. The vulnerability is exploitable by a low-privileged attacker with network access via HTTP and can lead to ...
CVE-2026-60369
CVE-2026-60369 affects Oracle Platform Security for Java (Oracle Fusion Middleware), specifically the Centralized Thirdparty Jars component. Affected versions are 12.2.1.4.0 and 14.1.2.0.0. An attacker with network access over HTTP and low privileges can compromise the affected product, with pote...
CVE-2026-60367
CVE-2026-60367 affects Oracle Platform Security for Java (Oracle Fusion Middleware) with the Centralized Thirdparty Jars component. Affected versions are 12.2.1.4.0 and 14.1.2.0.0. The vulnerability is exploitable over HTTP by an unauthenticated remote attacker, and successful exploits can lead t...
CVE-2026-60366
The CVE-2026-60366 entry concerns Oracle Fusion Middleware’s Oracle Platform Security for Java (Centralized Thirdparty Jars). Affected are 12.2.1.4.0 and 14.1.2.0.0. The vulnerability allows an unauthenticated, network-accessible attacker via HTTP to compromise Oracle Platform Security for Java, ...
CVE-2026-16630
Vulnerability detail (CVE-2026-16630): Syncfusion ej2-javascript-ui-controls up to v33.2.3 contains a flaw in the function child_process.exec of package.json that enables local OS command execution. Reports indicate local access is required, and the exploit has been publicly disclosed. Affected c...
CVE-2026-16629
A vulnerability exists in danger-js CLI up to 13.0.7 affecting the function danger.git.diffForFile in source/platforms/git/localGetFileAtSHA.ts. The issue arises from manipulating the File argument, enabling local OS command injection. Exploitation is described as local access, with partial impac...
CVE-2026-16628
The CVE-2026-16628 issue affects the oclif project up to version 4.23.16. The vulnerability lies in the JIT Plugin Entry Handler, where manipulating the jitPlugins argument allows local os command injection via child_process.exec. The attack requires local access; the exploit is public. A patch e...
CVE-2026-64793
CVE-2026-64793 affects Joomla Extensions Articles Anywhere and Modules Anywhere by regularlabs.com. The issue is that content tags could use ignore flags or property overrides to render restricted or unpublished articles/modules, allowing a content author to expose content to visitors who lack re...
CVE-2026-64794
Summary: CVE-2026-64794 affects Joomla extensions from regularlabs.com, specifically Users Anywhere and Articles Anywhere. The vulnerability stems from how user tags, filters, and conditions can access insufficiently restricted user fields, enabling exposure of authentication-related data, raw us...
CVE-2026-64797
Summary (CVE-2026-64797) : A Joomla extension (IP Login by regularlabs.com) is vulnerable to IP spoofing through forwarded client-IP headers without a configured trusted proxy. The underlying issue is trust in forwarded headers, allowing an attacker to spoof the login IP and potentially impersona...