379511 matches found
CVE-2026-18497 The nothings stb TrueType library contains a heap buffer overflow vulnerability
A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for parsing TrueType font files. The vulnerability exists in the stbttGetGlyphShapeTT function within the nothings stbtruetype.h library when parsing malformed TTF TrueType Font file...
CVE-2026-19264 Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover
Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and streams the file without normalising the path or confining it to that directory, and the route requires no authentication. Raw...
CVE-2026-61477
An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the...
CVE-2026-19206
A security flaw has been discovered in MZ Automation libiec61850 up to 1.6.1. This affects the function SVReceiverstopThreadless of the file src/sampledvalues/svsubscriber.c of the component ASDU Element Handler. Performing a manipulation results in heap-based buffer overflow. The attack must be...
CVE-2026-15570
An improper restriction of URL schemes and destinations in the SmartCenter browserseturl command in the Telefunken TE24553B45V2DZ Smart TV running on the Vestel MB181 / Voltron181 / TiVo OS platform allows an attacker with access to the same local network to cause the embedded browser to issue...
CVE-2026-66914
Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD 3.30.0, 4.7.0, 6.0.1 - An unauthenticated attacker could download files from both inside and outside the webroot...
CVE-2026-16637
OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlist and leak Earthdata headers User-Id, Echo-Token to attacker-controlled endpoints...
CVE-2026-66494
The vulnerability CVE-2026-66494 affects Joomla SP Page Builder via the Shapes API endpoint in the joomshaper Shapes extension, where unauthenticated stored XSS is possible in SP Page Builder versions before 6.7.0. An attacker can store malicious JavaScript in the Joomla site’s database with a si...
CVE-2026-48094
CVE-2026-48094 affects the ShareOpenly WordPress plugin (prior to 1.2.1). The issue is a Cross-Site Scripting (XSS) vulnerability caused by omitting WordPress esc_url() when rendering a URL into an HTML href. The vulnerable code builds the URL from home_url( add_query_arg( array(), $wp->reques...
CVE-2026-66838
CVE-2026-66838: A SQL injection via the :comment option in Postgrex.stream/4 (affecting postgrex up to 0.22.4, and Elixir/Ecto exposure through Ecto.Repo.stream/2) arises because Postgrex concatenates the comment into the statement text in the Parse message without escaping or validating it. This...
CVE-2026-56794
CVE-2026-56794 affects Dell OpenManage Server Administrator, prior to version 11.1.0.2. It is a Relative Path Traversal vulnerability that could be exploited by a low-privileged attacker with remote network access to gain filesystem access. The provided metrics assign a CVSS v3.1 base score of 6....
CVE-2026-56793
Technical details for CVE-2026-56793 are not publicly available in the provided documents. Monitor for updates on affected products, vulnerable components, impact, and remediation.
CVE-2026-15816
CVE-2026-15816 describes a vulnerability in dracut where the die() error-handling function writes its message into an initramfs emergency-hook script without proper shell-quoting. If the message contains data from the DHCP ROOT_PATH option, an adjacent attacker controlling a rogue DHCP server can...
CVE-2025-30374
CVE-2025-30374 is associated with Taipy (v4.0.3) and is tied to a class pollution vulnerability . The root cause is improper handling of client-supplied attribute paths in Taipy’s state management, via a recursive _set/attr mechanism, allowing an attacker to overwrite methods on objects (e.g., _T...
CVE-2026-38053
Technical details about CVE-2026-38053 are not publicly available in the provided documents; no affected products, root causes, or fixes are disclosed. Monitor for updates.
CVE-2026-54205
The vulnerability CVE-2026-54205 affects Tobit Laboratories AG TeamDavid’s Webbox link-storing functionality. The server-side code accepts a pathname parameter that can be a UNC network location (e.g., \Server\Share) without validation, causing outbound connections to attacker-controlled SMB endp...
CVE-2026-54218
CVE-2026-54218 affects Tobit Laboratories AG TeamDavid’s Webbox. The issue stems from use of a hard-coded cryptographic key and password storage across locally created users in David, where passwords are stored in various files using only obfuscation. If an attacker can access the server’s file s...
CVE-2026-54217
CVE-2026-54217 affects Tobit Laboratories AG TeamDavid’s Webbox. It describes a stored XSS where an attacker can embed malicious JavaScript in an email; when a user opens the email, the stored payload is executed. Affected scope is TeamDavid through Rollout 524. CVSSv4.0 vector: AV:N/AC:L/PR:N/UI...
CVE-2026-54216
CVE-2026-54216 affects Tobit Laboratories AG TeamDavid’s Webbox. The vulnerability is a reflected cross-site scripting (XSS) flaw in the application triggered by crafting a link with an arbitrary path and an XSS payload via the EntryInfo parameter, using the templateName=!templateName=entryMail, ...
CVE-2026-54215
CVE-2026-54215 affects Tobit Laboratories AG TeamDavid’s Webbox (through Rollout 524). The vulnerability is an open redirect triggered by the replyUrl parameter, enabling an attacker to craft a URL that redirects users’ browsers to an arbitrary third-party site. This can be abused for phishing by...
CVE-2026-54214
CVE-2026-54214 describes an HTTP header injection vulnerability in Tobit Laboratories AG TeamDavid’s Webbox. The vulnerability arises from the vulnerable Type URL parameter, which can inject control characters (e.g., URL-encoded newlines %0a and colons) to modify the Content-Type header in HTTP...
CVE-2026-54213
CVE-2026-54213 affects Tobit Laboratories AG TeamDavid’s Webbox. A public, unauthenticated request to the /internalRestart endpoint causes the server to shut down instead of restarting, enabling a remote attacker to trigger a persistent denial-of-service by taking the web server offline. Recovery...
CVE-2026-54212
CVE-2026-54212 affects Tobit Laboratories AG TeamDavid’s Webbox — an API endpoint is vulnerable to a buffer overflow in JSON parsing. A crafted JSON body (e.g., ≥8 chars starting with a number) can crash the server, causing denial of service and, depending on stack state or potential stack canary...
CVE-2026-54211
CVE-2026-54211 affects Tobit Laboratories AG TeamDavid's Webbox: endpoint //serverClient_close.html vulnerable to a buffer overflow in multiple form data parameters. Submitting excessively long values can crash the server, causing denial of service. Depending on stack state or if a stack canary i...
CVE-2026-54210
CVE-2026-54210 affects Tobit Laboratories AG TeamDavid’s Webbox, where a buffer overflow in file upload with excessively long filenames can crash the server (DoS) and, depending on stack state or disclosed stack canary, may enable remote code execution leading to full server compromise. Affected:...
CVE-2026-54209
The CVE-2026-54209 entry concerns Tobit Laboratories AG TeamDavid’s Webbox. A buffer overflow can occur in the editini path handling when the user writes to Archive.ini without verifying the target file. The vulnerability arises if an attacker specifies a different large file, triggering overflow...
CVE-2026-54208
The CVE affects Tobit Laboratories AG TeamDavid’s Webbox. An unauthenticated attacker can exploit an arbitrary file-write flaw (via unsafely written user input) to create/write files (e.g., .htm) containing JavaScript, triggering stored XSS when a user accesses the file. The issue affects TeamDav...
CVE-2026-54207
CVE-2026-54207 affects Tobit TeamDavid’s Webbox move-archive feature (ArcEntryMove). The function accepts an arbitrary path, including UNC network paths like \Server\Share, which the server processes without validation. This can trigger outbound connections to attacker-controlled SMB servers, all...
CVE-2026-54206
CVE-2026-54206 affects Tobit Laboratories AG TeamDavid’s Webbox. The issue is a server-side inclusion/SSRF via the pathname parameter in the sending functionality, which can be set to UNC paths (e.g., \Server\Share). The server processes these paths without validation, causing outbound connection...
CVE-2026-54204
CVE-2026-54204 affects Tobit Laboratories AG TeamDavid’s Webbox. The search function accepts a pathnameroot parameter that can be set to UNC network locations; the server processes these values without validation, causing outbound connections to attacker-controlled SMB endpoints. This enables una...
CVE-2026-54203
The CVE describes a memory leak in Tobit Laboratories AG TeamDavid’s Webbox. The vulnerability is triggered by accessing the endpoint /.well-known/mta-sts, allowing an unauthenticated attacker to repeatedly request the URL and potentially read sensitive information (including user passwords). It ...
CVE-2026-54202
The CVE-2026-54202 entry concerns Tobit Laboratories AG TeamDavid’s Webbox with a path traversal flaw in the archive creation function. The archive path is user-controlled and insufficiently validated, enabling an attacker to manipulate input to traverse directories and create folders in arbitrar...
CVE-2026-54201
The CVE-2026-54201 entry concerns Tobit Laboratories AG TeamDavid’s Webbox. The issue: missing authentication/authorization when serving log files, enabling attackers to obtain sensitive error information or internal application details. Affected component: TeamDavid through Rollout 524. The vuln...
CVE-2026-54200
The CVE-2026-54200 entry concerns Tobit Laboratories AG TeamDavid’s Webbox. It describes a local file inclusion vulnerability in the “send email, fax, SMS, etc.” function accessible via the form field scjob where an the command like @@attach can attach files to a message, enabling an authenticate...
CVE-2026-54199
Tobit Laboratories AG TeamDavid’s Webbox is vulnerable to HTTP header injection via the request body in the link-storing function (//ServerClient_celink.htm), which is appended to the redirect target in the 302 response. Inserting a line feed can propagate into the redirect URL, enabling control ...
CVE-2026-12071
The CVE-2026-12071 issue affects the Webbox of TeamDavid by Tobit Laboratories AG. The vulnerability stems from how redirect URLs are constructed using user-supplied input, which is appended to the redirect target in a 302 HTTP response. Technical details in the connected documents show that atta...
CVE-2026-12070
Affected software : Tobit Laboratories AG TeamDavid’s Webbox. Vulnerability : Arbitrary file deletion via an @@COMMENTFILE command in the form field scjob, enabling deletion of any file on the system. Impact : According to the CVE entry, this affects TeamDavid through Rollout 524, with high impac...
CVE-2026-71559
CVE-2026-71559 – Apache Fory (Go implementation) : The Go-based Apache Fory deserializes untrusted data and is exploitable via crafted data containing malformed type metadata, causing an uncaught panic and remote denial of service. Affected versions are 0.16.0 up to, but not including, 1.5.0; oth...
CVE-2026-71558
A heap type confusion vulnerability in Apache Fory C++ deserialization affects versions 0.14.0 up to (before) 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to be treated as the declar...
CVE-2026-71560
CVE-2026-71560: Apache Fory (C++) deserialization issue . Affected: Apache Fory C++ 0.14.0 up to before 1.5.0 when deserializing structs containing tagged integer fields. Root cause: out-of-bounds heap read in the tagged integer fast-path deserializer. Impact: potential information disclosure or ...
CVE-2026-9169
CVE-2026-9169 describes a DLL search order hijacking issue in LUCID Vision Labs Arena SDK 1.0.80.49 on Windows. An attacker with local access can place a malicious DLL in a user-controlled directory that appears in the PATH the SDK traverses to resolve a dependency, resulting in arbitrary code ex...
CVE-2026-18938
CVE-2026-18938 affects p11-kit: an integer overflow in RPC attribute-array length calculation on 32‑bit systems can under‑allocate nested attribute storage, causing a heap out‑of‑bounds write and DoS by crashing the p11-kit RPC parser. Affected component: p11-kit RPC decoding of nested attributes...
CVE-2026-66491
CVE-2026-66491 affects the Joomla extension phoca.cz Phoca Commander (versions 1.0.0–6.1.3). The issue is an improper limitation of paths in the getSource function, enabling an arbitrary file read. The CVSS v4 metrics indicate a high severity (8.2) with network attack vector, low attack complexit...
CVE-2026-66492
Phoca Commander (Joomla extension by phoca.cz) versions 1.0.0-6.1.3 expose a path traversal vulnerability in the file upload action, caused by improper limitation/validation of upload paths. This results in a path traversal flaw within the module. The connected documents confirm the affected prod...
CVE-2026-49008
The CVE-2026-49008 entry concerns the ZTE F689 product and describes an integrity-check credential leakage in an application function. The vulnerability arises from unencrypted information in device firmware that could allow an attacker to obtain credentials related to the integrity verification ...
CVE-2026-66493
CVE-2026-66493 affects the Joomla extension Phoca Commander (phoca.cz) versions 1.0.0 through 6.1.3. The issue is a path traversal vulnerability caused by improper limitation of paths for delete, copy, and move actions. The CVSS data indicates NETWORK access with low complexity and high privilege...
CVE-2026-49007
CVE-2026-49007 affects the ZTE F689 device. The issue arises from unencrypted information in the device firmware, enabling an attacker to obtain the initial login credentials for the web interface. Root cause: firmware exposes credentials in plaintext or unprotected form. Impact: credential discl...
CVE-2026-15239
CVE-2026-15239 affects the Simple CAPTCHA with Cloudflare Turnstile WordPress plugin (pre-1.42.0). The vulnerability arises because the Turnstile validation cache isn’t bound to the single-use challenge token, instead tying to an attacker-controlled reusable request value, enabling unauthenticate...