410547 matches found
CVE-2026-43850
A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system...
CVE-2026-43849
A heap memory read vulnerability could allow an attacker to exfiltrate sensitive data...
CVE-2026-43848
A vulnerability in the bulk port configuration functionality could allow an unauthenticated attacker to crash the service...
CVE-2026-43847
A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without restrictions, even when the SafeEnhancement feature is enabled...
CVE-2026-43846
A stack-based buffer overflow vulnerability in a non-functional feature could allow an authenticated attacker to achieve code execution...
CVE-2026-43845
A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism...
CVE-2026-43844
A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism...
CVE-2026-43843
An integer overflow vulnerability in the license manager service could allow an unauthenticated attacker to crash the service...
CVE-2026-43842
A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the rpcrxfsm function when msglen is set to 0...
CVE-2026-43841
A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the rpcrxfsm function...
CVE-2026-113469 Improper Signature Verification of Active Update Files
A failure has been identified in the SNS during dynamic data files signature check. A logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine...
CVE-2026-43840
A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the ondisconnected callback function...
CVE-2026-43839
A NULL pointer dereference vulnerability in the logs management functionality could allow an unauthenticated attacker to crash the service...
CVE-2026-101201 QBinaryJson::fromBinaryData() integer overflow leading to OOB read
A malformed header in the binary file fed to QBinaryJson::fromBinaryData can cause undefined behaviour because of out-of-bounds read...
CVE-2026-43838
A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution...
CVE-2026-92287 Apache Arrow C++, PyArrow: Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation
Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects users who read Parquet files and configure Parquet decryption properties with a KmsClient implementation. On the reader side, the KMS URL can be application-controlled...
CVE-2026-43837
A buffer overflow vulnerability in the password verification functionality could allow an attacker with guest authentication to achieve code execution...
CVE-2026-11960 Multiple vulnerabilities in FacturaScripts
Enumeration of unauthenticated users in FacturaScripts, version 2025.61. The application returns different responses when attempting to log in with a valid username compared to an invalid one. An unauthenticated attacker could systematically identify valid usernames by examining variations in the...
CVE-2026-11959 Multiple vulnerabilities in FacturaScripts
Stored Cross-Site Scripting XSS in FacturaScripts, version 2025.61, caused by a lack of adequate validation or sanitisation of user input in the ‘city’ and ‘province’ fields in the ‘ListAlmacen’ endpoint. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary...
CVE-2026-113465 Possible DOM XSS in SNS Web Administration Portal
It is possible to execute a DOM-based Cross-Site Scripting attack against Stormshield’s web administration panel. To exploit this vulnerability, an attacker would need to craft a URL containing a malicious script payload within a specific parameter and lure an authenticated administrator into...
CVE-2026-43836
A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges...
CVE-2026-43835
A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file, potentially compromising the device permanently...
CVE-2026-43834
A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to achieve code execution...
CVE-2024-2323 Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery
The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This oversight allows an attacker to repeatedly attempt password guesses for a user account without being adequately restricted. Exploiting this...
CVE-2026-111090 Improper Signature Verification of Firmware Update Files
A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license files.It is necessary to use only the MyStormshield servers to retrieve update files or licenses, or to use automatic verification via SNS...
CVE-2026-112177 Ghostscript: reintroduction of .charkeys -dsafer bypass in rhel 8
A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted...
CVE-2026-113407 YS-infoware｜BA-Workflow - SQL Injection
BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents...
CVE-2026-113406 YS-infoware｜BA-Workflow - SQL Injection
BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents...
CVE-2026-113405 YS-infoware｜BA-Workflow - SQL Injection
BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents...
CVE-2026-110725 fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize, normalize, or resolve are called with the non-default option reference set to suffix on a reference that has no authority...
CVE-2026-113403 ArmorX Global Technology｜ArmorX Spam - Command Injection
ArmorX Spam developed by ArmorX Global Technology has a Command Injection vulnerability. Authenticated remote attackers can inject crafted commands into a specific parameter, thereby uploading malicious code to the server...
CVE-2026-110306 fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape function before validating it, so an input whose decoded...
CVE-2026-110180 fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1 through 4.2.2, for HTTP-family schemes the canonicalizeHost function passes the parsed host to the WHATWG URL parser and adopts its hostname...
CVE-2026-110095 fast-uri vulnerable to improper path equivalence in relative reference normalization
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize and serialize functions apply RFC 3986 dot-segment removal to the path of a relative-path reference, even though that...
CVE-2026-93878 DiviGear Carousel <= 5.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via update_license AJAX Action
The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via updatelicense AJAX Action in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...
CVE-2026-112148
A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting XSS flaw allows an attacker to execute arbitrary JavaScript in the origin of an affected LIFF application's endpoint when a user opens a specially crafted URL in an external...
CVE-2026-113402 ArmorX Global Technology｜ArmorX Spam - Local File Inclusion
ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability. Authenticated remote attackers can exploit path traversal to cause the application to include PHP files outside the intended directory...
CVE-2026-113404 Uniong｜WebITR - Insecure Deserialization
WebITR developed by Uniong has a Insecure Deserialization vulnerability. Authenticated remote attackers can use the hard-coded cryptographic key to craft and submit malicious serialized data, thereby executing arbitrary code on the server...
CVE-2026-96903 Easy Property Listings < 3.5.27 - Subscriber+ Sensitive Data Disclosure via Contact CRM AJAX Handlers
The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead records, including their private...
CVE-2026-96902 Easy Property Listings < 3.5.28 - Unauthenticated Hidden Listing Details Disclosure via REST API
The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, sold price, street address and exact ma...
CVE-2026-93300 EventON - Subscriber <= 1.4.5 - Unauthenticated SQL Injection via 'email' Parameter
The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...
CVE-2026-97627
Hidden functionality issue exists in Multiple DVRs Digital Video Recorders provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privilege may execute arbitrary OS commands...
CVE-2026-100737
Hidden functionality issue exists in Multiple DVRs Digital Video Recorders provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privilege may upgrade the affected product to unauthorized firmware...
CVE-2026-113386
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the uid parameter of the mail/headers and mail/viewsource actions to execute arbitrary IMAP commands...
CVE-2026-109831
UnRTF by GNU Project is vulnerable to out-of-bounds write. If a user opens an RTF file crafted by an attacker, it may lead to a denial-of-service DoS condition...
CVE-2026-113380
In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call with its audio and perhaps also video track down...
CVE-2026-86467 Apache Airflow Amazon provider: AWS auth manager: SAML login CSRF logs users into the attacker's account
Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it. The login handler discards the AuthnRequest ID and the callback validates the assertion without requiring a matching InResponseTo, so an unauthenticated...
CVE-2026-12489
An incorrect authorization vulnerability in the Data Access Layer DAL of Zyxel EX3501-T0 firmware versions through 5.44ACHR.6C0 could allow an authenticated attacker to escalate privileges by modifying the loginprivilege data on an affected device...
CVE-2026-75753
Missing Authentication for a Critical Function in certain ASUS routers allows an unauthorized nearby user to send specific commands via HTTP requests, causing the router to return device identification information and switch into a specific mode. As a result, when the router encounters abnormal...
CVE-2026-17518
Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrupt device operations and cause a denial of service via an HTTP request with input exceeding the expected length. Refer to the ' Security Update for ASUS Router Firmware' section ...