396932 matches found
CVE-2026-91752 GNU libextractor before 1.15 Stack Overflow via OLE2
GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the processstaroffice function that sizes a variable-length stack array from attacker-controlled OLE2 stream data. Attackers can craft malicious StarOffice documents that allocate up to 4 MB on the stack, causing...
CVE-2026-91750 WeKnora before 0.7.0 SSRF via Unvalidated HTTP Redirects
WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when downloading documents from user-supplied URLs. Authenticated attackers can bypass initial SSRF validation by supplying a public URL that redirects to internal networ...
CVE-2026-91751 Flextype CMS through 1.0.0-alpha.3 Path Traversal via Entries REST API
Flextype CMS through 1.0.0-alpha.3 fails to properly validate id and newid parameters in the Entries REST API, allowing API token holders to read, create, or overwrite files outside the entries directory. Attackers can use traversal sequences in API requests to escape the project entries director...
CVE-2026-90845 PHPGurukul Daily Expense Tracker System sidebar.php cross site scripting
A flaw has been found in PHPGurukul Daily Expense Tracker System 1.1. This issue affects some unknown processing of the file /dets/includes/sidebar.php. Executing a manipulation of the argument FullName can lead to cross site scripting. The attack can be executed remotely. The exploit has been...
CVE-2026-90844 PHPGurukul Daily Expense Tracker System Login index.php sql injection
A vulnerability was detected in PHPGurukul Daily Expense Tracker System 1.1. This vulnerability affects unknown code of the file /dets/index.php of the component Login. Performing a manipulation of the argument email results in sql injection. Remote exploitation of the attack is possible. The...
CVE-2026-90843 SabyasachiRana WebMap New Nmap Scan functions_nmap.py nmap_newscan os command injection
A security vulnerability has been detected in SabyasachiRana WebMap up to 8b95fe4dc301a3c09ddf145b895de0bf9f8d2a25. This affects the function nmapnewscan of the file functionsnmap.py of the component New Nmap Scan Handler. Such manipulation of the argument target/params leads to os command...
CVE-2026-90842
A weakness has been identified in PHPGurukul Blood Donor Management System 1.0. Affected by this issue is some unknown functionality of the file application/models/admin/LoginModel.php. This manipulation of the argument password/email/currentpassword/dbcurrentpwd/newpassword causes cleartext...
CVE-2026-90841
A security flaw has been discovered in PHPGurukul Blood Donor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /application/controllers/admin/Report.php of the component Report Endpoint. The manipulation of the argument fromdate/todate results in sql...
CVE-2026-90840
A vulnerability was identified in PHPGurukul Blood Donor Management System 1.0. Affected is the function construct of the file /application/controllers/admin/Dashboard.php of the component Admin Controllers. The manipulation leads to improper authentication. The attack can be initiated remotely...
CVE-2026-90835
A flaw has been found in michaelliao itranswarp up to 2.19. The impacted element is the function Markdown.toHtml of the file Markdown.java of the component Page Content Rendering. This manipulation causes cross site scripting. The attack may be initiated remotely. The exploit has been published a...
CVE-2026-90831
A memory corruption vulnerability was identified in GNU Binutils 2.47 , specifically in the function _bfd_elf_strtab_delref within the file bfd/elf-strtab.c of the ELF String Table component. The flaw is triggered through local manipulation and can lead to partial compromise of confidentiality, i...
CVE-2026-90830
A null pointer dereference vulnerability was identified in GNU Binutils 2.47 , specifically in the function _bfd_write_merged_section within the file bfd/merge.c (component: Section Merge). The attack requires local access with low privileges. The exploit has been publicly disclosed as a proof-of...
CVE-2026-75945
Arista EOS 4.36.1F is affected by a race condition (CWE-459 Incomplete Cleanup) in the 802.1X authenticator mode with per-supplicant ACL enforcement. When the clear dot1x host all command is issued, the race condition may leave a supplicant in an authorized state, allowing it to continue transmit...
CVE-2026-75944
CVE-2026-75944 is a race condition in Arista EOS 802.1X supplicant re-authentication that may leave a stale ACL entry in the system. If the AclAgent subsequently restarts, the stale entry can be applied to new supplicants, causing incorrect access control enforcement. The vulnerability requires 8...
CVE-2026-90829
GNU Binutils 2.47 is affected by a null pointer dereference in the function bfd_elf_set_group_contents within the file bfd/elf.c , part of the SHT_GROUP Section Handler component. The flaw is triggered by local manipulation and results in low impact on confidentiality, integrity, and availability...
CVE-2026-75943
Arista EOS contains a brief traffic leak (milliseconds to seconds) in 802.1X with ACL-based authorization . When an authenticated supplicant is removed via the clear dot1x host all command or due to a supplicant timeout, its traffic may pass without ACL enforcement due to incomplete cleanup (CWE-...
CVE-2026-91201
DocsGPT through 0.20.0 is affected by an OAuth token disclosure via a wildcard postMessage in the callback-status endpoint. Session tokens are posted without validating the sender origin, allowing an attacker acting as window.opener during the OAuth authorization flow to steal session tokens and ...
CVE-2026-91200
DevSpace versions through 6.3.21 contain a path traversal vulnerability in the in-pod sync stream's tar extraction logic. The tool fails to reject parent-directory segments in tar entry names, allowing an attacker operating a malicious container to stream tar entries with traversal sequences that...
CVE-2026-91199
Refly (versions through 1.1.0) is affected by a server-side request forgery (SSRF) vulnerability in the POST /v1/misc/scrape endpoint. The endpoint fetches caller-supplied URLs without validating the scheme, host, or resolved address, allowing authenticated attackers to make the backend issue req...
CVE-2026-91197
Flowable flowable-engine through 8.0.0 contains an XML External Entity (XXE) injection in ProcessDiagramLayoutFactory.parseXml() , which fails to disable external entity resolution when parsing deployed BPMN resources. Attackers with process deployment privileges can embed DOCTYPE declarations wi...
CVE-2026-91198
GrowthBook through version 5.0.1 is affected by an information disclosure vulnerability in its unauthenticated public report and experiment endpoints. The root cause is that fact table definitions , including raw warehouse SQL , are returned unredacted in the response payloads. An attacker who kn...
CVE-2026-81900
Concrete CMS before 9.5.3 is affected by a stored cross-site scripting vulnerability in the YouTube block (vWidth/vHeight). The root cause is that only trim() was applied to the stored width and height values before printing them into iframe HTML attributes , without escaping or integer casting. ...
CVE-2026-14986
An out-of-bounds write in the ITE it51xxx I2C driver in Zephyr RTOS (drivers/i2c/i2c_ite_it51xxx.c) occurs when the driver operates as an I2C target in buffer mode. The FIFO interrupt handler target_i2c_isr_fifo() copies host-supplied data into a fixed 256-byte buffer but performs its bounds chec...
CVE-2026-77191
CVE-2026-77191 affects Arista EOS with 802.1X authentication and ACL-based per-supplicant authorization configured. When hardware ACL resources reach capacity during bulk authentication, an authenticated supplicant on an adjacent network segment may send unrestricted traffic during a brief window...
CVE-2026-18116
Concrete CMS versions 8.3.0 through 9.5.2 are affected by a Stored XSS in calendar event names. Event names were stored without sanitization and rendered without HTML escaping in the workflow approval/deletion notifications within the dashboard "Waiting For Me" block. A registered user with permi...
CVE-2026-90828
A null pointer dereference vulnerability in GNU Binutils 2.47 , specifically in the function elf_orphan_compatible within the file ld/ldelf.c (ELF Orphan Section Handler component), allows a local attacker to cause a denial of service with partial impact on confidentiality and integrity. A public...
CVE-2026-73449
Arista EOS is vulnerable when both 802.1X port authentication and RADIUS proxy are configured with dynamic authorization. A low-privileged attacker on an adjacent network segment can induce a RADIUS packet through a configured RADIUS proxy client, preventing Change-of-Authorization (CoA) and Disc...
CVE-2026-91146
Takahe versions through 0.11.0 fail to restrict URL schemes in link hrefs within federated post content and profile summaries. This allows remote attackers to inject javascript: links that execute in the instance origin when a user clicks them, enabling session hijacking or impersonation of viewe...
CVE-2026-91145
Activiti through 7.1.0.M6 contains an expression injection vulnerability in its mail task handling. The root cause is a failure to validate hash-brace (#{}) deferred expressions in process variables, allowing an attacker to bypass expression filtering. Injected expressions are stored and later ev...
CVE-2026-91144
ZFile through 5.0.5 suffers from a share entry filter bypass on its download endpoint. The application fails to validate requested file paths against a share link's allowed entries, allowing an attacker holding a valid share link to supply arbitrary file paths as query parameters and download any...
CVE-2026-91143
goproxy through version 15.3 fails to enforce HTTP basic authentication on CONNECT tunnel requests. An unauthenticated attacker on the network can issue a CONNECT request to establish a tunnel through the authenticated proxy without providing credentials, enabling arbitrary TCP traffic relay and ...
CVE-2026-90827
GPAC 26.07.0 contains a use after free vulnerability in the function gf_node_deactivate_ex within the file scenegraph/base_scenegraph.c of the MP4Box component. The flaw is exploitable via a local attack with low complexity and low privileges required, resulting in a low impact on availability (C...
CVE-2026-12944
IBM Langflow OSS 1.0.0 through 1.10.0 contains a vulnerability in its code security scanner where the DANGEROUS_IMPORTS blocklist correctly blocked subprocess but omitted the socket and urllib standard library modules. This allowed authenticated users to submit components containing socket.connec...
CVE-2026-76081
ZITADEL , an open source identity management platform, contains a permission revocation flaw affecting versions prior to 4.16.0 . When multiple project roles are deleted simultaneously, a bug in the permission-update logic can cause some User Grants on Granted Projects (projects shared between or...
CVE-2026-90826
GPAC 26.07.0 contains an out-of-bounds read in the gf_node_del function within scenegraph/base_scenegraph.c (component MP4Box ). The flaw is triggered via local execution with low privileges and requires user interaction, resulting in a partial availability impact (denial of service). CVSS 3.1 sc...
CVE-2026-18117
Concrete CMS 9.0.0 through 9.5.3 contains a stored XSS vulnerability in the custom page alias name (customAliasName) field. The root cause is that the Edit Alias dialog applied only trim() to the submitted value without performing input neutralization. An authenticated user with canWrite (editor)...
CVE-2026-91181
CVE-2026-91181 affects Mattermost versions 11.9.0 and earlier, 11.8.4 and earlier, 11.7.7 and earlier, and 10.11.22 and earlier. The data retention teams endpoint (GET /api/v4/data_retention/policies/{policy_id}/teams) fails to sanitize Team objects, allowing an authenticated user with only the r...
CVE-2026-12756
IBM Business Automation Workflow (containers and traditional) is vulnerable to an XML External Entity (XXE) injection when processing XML data. A remote attacker with low privileges could exploit this to expose sensitive information or consume memory resources . The vulnerability is rated CVSS 7....
CVE-2026-12758
IBM Cloud Pak for Business Automation is vulnerable to an authorization bypass caused by improper validation of HTTP headers. A remote attacker with low privileges can exploit this to invoke restricted endpoints, resulting in low confidentiality and low integrity impact (CVSS 3.1 score 5.4, MEDIU...
CVE-2026-90825
CVE-2026-90825 is a use-after-free vulnerability in the MP4Box component of GPAC 26.07.0 , specifically in the gf_node_unregister function within scenegraph/base_scenegraph.c. Exploitation requires local access and low privileges, with no user interaction needed, resulting in a low availability i...
CVE-2026-12759
CVE-2026-12759 affects IBM Cloud Pak for Business Automation (specifically IBM Business Automation Workflow ), where an authenticated user can trigger uncontrolled resource consumption leading to a denial of service (CWE-400). The vulnerability is rated CVSS 6.5 (Medium) with network attack vecto...
CVE-2026-13265
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker with MFT publish authority to obtain sensitive information or...
CVE-2026-13275
IBM MQ Managed File Transfer is vulnerable to XML External Entity (XXE) injection in reply message processing (CWE-611). An authenticated attacker can exploit this to read arbitrary files or perform server-side request forgery (SSRF) . Affected versions span 9.1 LTS (≤9.1.0.37), 9.2 LTS (≤9.2.0.4...
CVE-2026-13285
IBM MQ Managed File Transfer is vulnerable to XML external entity injection (XXE) in its template parser (CWE-611). A remote attacker with low privileges can exploit this over the network to expose sensitive information or consume memory resources, rated CVSS 7.1 HIGH (C:H, I:N, A:L). Affected ve...
CVE-2026-13293
IBM MQ Java messaging (JMS client) is vulnerable to remote code execution due to a bypass of the Java deserialization allowlist, enabling an authenticated attacker to execute arbitrary code on systems consuming JMS ObjectMessages. The flaw is classified as CWE-502 (Deserialization of Untrusted Da...
CVE-2026-13287
IBM MQ is vulnerable to an XML external entity injection (XXE) in the Managed File Transfer monitor result parser (CWE-611). A remote attacker with low privileges can exploit this to expose sensitive information or consume memory resources . Affected versions span 9.1 through 10.0.0.0 across LTS ...
CVE-2026-14275
CVE-2026-14275 affects IBM i Access Client Solutions (ACS) , versions 1.1.2.0 through 1.1.9.15. An authenticated user can execute arbitrary commands with normal user privileges by exploiting improper validation of user-supplied input in a STRPCCMD CL command (CWE-78, OS Command Injection). The vu...
CVE-2026-14276
IBM i Access Client Solutions (versions 1.1.2.0 through 1.1.9.15 ) is affected by an OS command injection vulnerability (CWE-78) in the emulator macro RunProgram action . An authenticated user can supply malicious input to this action, allowing arbitrary command execution with normal user privile...
CVE-2026-14277
IBM i Access Client Solutions (ACS) , versions 1.1.2.0 through 1.1.9.15 , is affected by an OS command injection vulnerability (CWE-78) caused by improper validation of user-supplied input in a session file . An authenticated user can exploit this to execute arbitrary commands with normal user pr...