398550 matches found
CVE-2026-95657 dgtlmoon Changedetection.io Visual Selector visual-selector.js setCurrentSelectedText cross site scripting
A vulnerability was determined in dgtlmoon Changedetection.io up to 0.55.8. This issue affects the function setCurrentSelectedText of the file changedetectionio/static/js/visual-selector.js of the component Visual Selector. Executing a manipulation of the argument s can lead to cross site...
CVE-2026-75703 Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)
Adobe Campaign Classic ACC is affected by an Improper Control of Generation of Code 'Code Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue...
CVE-2026-84412 Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)
Adobe Campaign Classic ACC is affected by an Improper Control of Generation of Code 'Code Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue...
CVE-2026-83660 Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)
Adobe Campaign Classic ACC is affected by a Server-Side Request Forgery SSRF vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed...
CVE-2026-89276 Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)
Adobe Campaign Classic ACC is affected by an Improper Control of Generation of Code 'Code Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation o...
CVE-2026-82013 Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)
Adobe Campaign Classic ACC is affected by a Server-Side Request Forgery SSRF vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user...
CVE-2026-82009 Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to...
CVE-2026-82003 Adobe Campaign Classic (ACC) | Improper Input Validation (CWE-20)
Adobe Campaign Classic ACC is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the...
CVE-2026-75721 Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)
Adobe Campaign Classic ACC is affected by an Improper Control of Generation of Code 'Code Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue...
CVE-2026-75723 Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)
Adobe Campaign Classic ACC is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction...
CVE-2026-75699 Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)
Adobe Campaign Classic ACC is affected by an Improper Control of Generation of Code 'Code Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue...
CVE-2026-73369 Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)
Adobe Campaign Classic ACC is affected by an Improper Control of Generation of Code 'Code Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue...
CVE-2026-82011 Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthoriz...
CVE-2026-82443 Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)
Adobe Campaign Classic ACC is affected by a Server-Side Request Forgery SSRF vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user...
CVE-2026-82008 Adobe Campaign Classic (ACC) | Improper Input Validation (CWE-20)
Adobe Campaign Classic ACC is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require...
CVE-2026-75728 Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)
Adobe Campaign Classic ACC is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction...
CVE-2026-89275 Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)
Adobe Campaign Classic ACC is affected by an Improper Control of Generation of Code 'Code Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue...
CVE-2026-82010 Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute...
CVE-2026-77258 MCP Atlassian: Arbitrary file read/exfiltration via upload_attachment missing validate_safe_path()
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, uploadattachment in src/mcpatlassian/confluence/attachments.py accepts a caller-controlled filepath and opens the selected server-local file without restricting it to the workspace. A...
CVE-2026-77274 MCP Atlassian: SSRF Protection Bypass
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, validateurlforssrf has a backslash authority confusion because it interprets the authority differently from the Requests connection layer in the header-based Jira and Confluence URL...
CVE-2026-95624 Tauri framework v2 malicious downgrade via allow_downgrades from frontend code
The Tauri updater plugin's 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When set to true, it replaces the version comparator from "update must be newer" to "update must be different." Because the default permission set grants allow-check...
CVE-2026-95656 dgtlmoon changedetection.io Preview Endpoint __init__.py add_watch_ui_snapshot server-side request forgery
A vulnerability was found in dgtlmoon changedetection.io up to 50389b07. This vulnerability affects the function addwatchuisnapshot of the file changedetectionio/blueprint/addwatchui/init.py of the component Preview Endpoint. Performing a manipulation of the argument url results in server-side...
CVE-2026-85995 Notepad++: Authenticode verification bypass allows modified updater execution
Notepad++ is a free and open-source source code editor. From 8.9.7 until 8.9.8, the Notepad++ updater and signature verification path can accept a modified GUP.exe file whose embedded certificate metadata remains present even though its Authenticode digest is invalid. An attacker who can replace ...
CVE-2026-86056 Notepad++: Null pointer dereference in NPPM_SAVESESSION message handler causes crash (DoS)
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the NPPMSAVESESSION handler in PowerEditor/src/NppBigSwitch.cpp converts lParam to a sessionInfo pointer and dereferences its nbFile, files, and sessionFilePathName members without checking for null. A process running at the...
CVE-2026-77605 Notepad++ “Run by system” executes *.txt.cmd when user selected *.txt (target confusion → command execution)
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the Folder as Workspace Run by system action in Notepad++ can resolve a different sibling file than the file selected by the user. When an attacker places a command script whose name is the selected text-file path with .cmd...
CVE-2026-86054 Notepad++: Stack Buffer Overflow in `NppParameters::writeSession` via overlong session path
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ contains a stack buffer overflow in NppParameters::writeSession in PowerEditor/src/Parameters.cpp because it copies a session path derived from -settingsDir= into backupPathNameMAXPATH with unbounded wcscpy and...
CVE-2026-85288 Notepad++: Shortcuts.xml macro HMAC bypass still reachable via the "Run a Macro Multiple Times" dialog
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ incompletely enforces shortcuts.xml HMAC validation because WMMACRODLGRUNMACRO, the Run a Macro Multiple Times entry point, calls macroPlayback without the validation used by command. A tampered shortcuts.xml macro...
CVE-2026-85279 Notepad++: Stack Buffer Overflow in Plugin Lexer Loading via Unchecked GetLexerCount() Return Value
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ contains a stack buffer overflow in PluginsManager::loadPluginFromPath in PowerEditor/src/MISC/PluginsManager/PluginsManager.cpp because the plugin-supplied GetLexerCount result controls a loop that writes to...
CVE-2026-93345 MikroTik RouterOS < 7.25beta4 Improper Input Validation DoS via BGP Labelled-VPN NLRI
MikroTik RouterOS before 7.25beta4 contains an improper input validation vulnerability in the labelled-VPN NLRI iterators of the routing service that allows an unauthenticated on-path attacker to crash the BGP service by sending a malformed MPREACHNLRI UPDATE message with a prefix-length value...
CVE-2026-94384 Missing Authorization in sfExecuteAWSService Lambda Dispatcher in Amazon Connect Salesforce Lambda
Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principal with lambda:InvokeFunction permission on the affected function to escalate privileges and perform AWS API operations that their own IAM identity is explicitly denied, via invocation of a Lambda...
CVE-2026-83597 Netdata: Local Privilege Escalation in Netdata Windows Agent installer via MSI Repair Execution
Netdata is an open source observability tool. From version 2.0.0 until 2.10.4, Netdata Windows Agent MSI repair launches powershell.exe and wevtutil.exe as elevated interactive processes in the initiating user's desktop session. A low-privileged local user who triggers repair can interact with or...
CVE-2026-83600 Netdata: Streaming protocol chart slot guard off-by-one allows ~16 GiB allocation request, crashing parent agent
Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized CHART SLOT value that str2ullencoded passes to pluginsdrrdsetcacheputtoslot in src/plugins.d/pluginsdinternals.h. The accepted slot drives reallocz to request an approximately 16 GiB...
CVE-2026-83598 Netdata: Local Privilege Escalation in Netdata Agent Windows installer via PowerShell Profile Hijack in MSI Repair
Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Agent MSI repair, powershell.exe runs as SYSTEM without -NoProfile and loads %USERPROFILE%\Documents\WindowsPowerShell\Microsoft.PowerShellprofile.ps1 from the low-privileged user who initiated repai...
CVE-2026-83603 Netdata: Local Root via ndsudo Arbitrary socket_path → fail2ban-client Pickle RCE
Netdata is an open source observability tool. Prior to 2.10.4, the setuid-root ndsudo helper command fail2ban-client-status-socket in src/collectors/utils/ndsudo.c accepts a caller-controlled --socketpath from the low-privileged netdata service account. The account can direct root fail2ban-client...
CVE-2026-83601 Netdata: Streaming protocol dimension slot has no upper-bound guard, allowing integer overflow and out-of-bounds write
Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized DIMENSION SLOT value that str2ullencoded passes to pluginsdrrddimputtoslot in src/plugins.d/pluginsdinternals.h without an upper bound. prdarraycreate in...
CVE-2026-83602 Netdata: Unauthenticated remote PUT to /api/v3/settings bypasses IP allowlist controls via HTTP_ACL_NOCHECK
Netdata is an open source observability tool. From 2.0.0 until 2.11.0, Netdata registers /api/v3/settings in src/web/api/v3/webapiv3.c with HTTPACLNOCHECK and HTTPACCESSANONYMOUSDATA, causing unauthenticated PUT requests handled by src/web/api/v3/apiv3settings.c to bypass operator-configured allo...
CVE-2026-83599 Netdata: WebSocket Decompression Bomb
Netdata is an open source observability tool. Prior to 2.11.0, Netdata's unauthenticated WebSocket server negotiates permessage-deflate before authentication, and src/web/websocket/websocket-compression.c allows websocketclientdecompressmessage to grow decompressed output toward...
CVE-2026-13087 Kernel: heap out-of-bounds write in the linux kernel rpc-over-rdma server reply path...
A heap out-of-bounds write vulnerability was found in the Linux kernel's RPC-over-RDMA server reply path in net/sunrpc/xprtrdma/svcrdmasendto.c. When a crafted RPC-over-RDMA client sends a large NFS READ request with an empty Write list and no Reply chunk, the server linearizes the entire...
CVE-2026-84301 FastGPT safe axios SSRF guard still allows DNS rebinding TOCTOU on protected outbound requests
FastGPT is an open-source LLM platform for building AI applications on a knowledge base. Prior to 4.15.2, the safe Axios request interceptor in packages/service/common/api/axios.ts validates a hostname with isInternalAddress before a later HTTP connection performs an independent DNS lookup,...
CVE-2026-95818 AT_SECURE program buffer overflow via $ORIGIN processing
A stack-based buffer overflow in the dynamic loader ld.so of the GNU C Library glibc versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid ATSECURE programs. When such a program's DTRPATH or DTRUNPATH begins with $ORIGIN and is followed by NUL or '/' t...
CVE-2026-76805 Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST/fuzz payload path in pkg/fuzz/parts.go can evaluate substituted runtime data more than once, creating a second evaluation pass that allows response content captured by an internal: true extractor...
CVE-2026-76802 Nuclei: Arbitrary Command Execution via DAST Code Signature Bypass
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST template loading branch does not apply the unsigned code-template signature check before accepting a template that contains both a fuzzing: block and an unsigned code: block. When an operator...
CVE-2026-87902
An unauthenticated attacker can make getpagetemplate page-template resolution include a chosen readable local .php file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE...
CVE-2026-76804 Nuclei: Local File Read via Workflow File-Protocol Gate Bypass
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loading path does not enforce the -file capability gate when resolving file: protocol templates referenced by a workflow. An untrusted unsigned workflow can therefore load a...
CVE-2026-76803 Nuclei: Local File Read via MySQL Client Sandbox Bypass
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the nuclei/mysql JavaScript library does not enforce the local-file sandbox when a JavaScript template supplies the allowAllFiles MySQL DSN option. An untrusted javascript: template scanning an...
CVE-2026-83803 Sentry: Unsafe pickle deserialization in Relocation Feature
Sentry is an error tracking and performance monitoring tool. From 23.11.0 until 26.7.0, Sentry instances with the relocation feature enabled unsafely deserialize a legacy database field while importing a user-supplied relocation archive. An authenticated user can craft an archive that causes...
CVE-2026-86062 LightRAG: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, lightragwebui/src/components/retrieval/ChatMessage.tsx renders answer and thinking content with react-markdown, rehypeRaw, and skipHtml=false without an HTML sanitizer. An attacker who can add a document can store r...
CVE-2026-85740 LightRAG: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, validatedaddresses in lightrag/parser/markdown/parser.py evaluates the literal resolved address with ipaddress.isglobal without consistently classifying an IPv4 address embedded in an IPv6 transition wrapper. A call...
CVE-2026-85734 LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login endpoint in lightrag/api/lightragserver.py does not impose a rate limit, account lockout, delay, or counter for failed authentication attempts. A network attacker can submit password guesses at full...