165540 matches found
CVE-2026-59797
Improper Privilege Management vulnerability in Apache HTTP Server's modssl via SSLRequire and file-related expressions. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...
CVE-2026-81383
Use of incorrectly-resolved name or reference in Visual Studio Code allows an unauthorized attacker to disclose information over a network...
CVE-2026-81380
Improper neutralization of special elements used in a command 'command injection' in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network...
CVE-2026-81379
Not failing securely 'failing open' in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...
CVE-2026-81356
Inconsistent interpretation of http requests 'http request/response smuggling' in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...
CVE-2026-81381
Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network...
CVE-2026-81378
Interpretation conflict in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...
CVE-2026-81357
Server-side request forgery ssrf in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...
CVE-2026-78462
Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...
CVE-2026-69306
Not failing securely 'failing open' in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...
CVE-2026-69320
Improper neutralization of special elements used in an os command 'os command injection' in Visual Studio Code allows an unauthorized attacker to execute code over a network...
CVE-2026-69278
Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...
CVE-2026-65675
No cwe for this issue in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to bypass a security feature over a network...
CVE-2026-58650
Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...
CVE-2026-70335
Improper neutralization of special elements used in an os command 'os command injection' in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally...
CVE-2026-47285
Improper neutralization of special elements used in a command 'command injection' in Visual Studio Code allows an unauthorized attacker to disclose information over a network...
CVE-2026-59113
Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network...
CVE-2025-48883
Chrome PHP allows users to start playing with chrome/chromium in headless mode from PHP. Prior to version 1.14.0, CSS Selector expressions are not properly encoded, which can lead to XSS cross-site scripting vulnerabilities. This is patched in v1.14.0. As a workaround, users can apply encoding...
CVE-2026-70336
Improper control of generation of code 'code injection' in Visual Studio Code allows an unauthorized attacker to execute code over a network...
CVE-2026-34070
LangChain is a framework for building agents and LLM-powered applications. Prior to version 1.2.22, multiple functions in langchaincore.prompts.loading read files from paths embedded in deserialized config dicts without validating against directory traversal or absolute path injection. When an...
CVE-2020-25633
A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final. It may allow client users to obtain the server's potentially sensitive information when the server got WebApplicationException from the RESTEasy client call. The highest threat from this vulnerability is to data...
CVE-2019-15028
In Joomla! before 3.9.11, inadequate checks in comcontact could allow mail submission in disabled forms...
CVE-2026-9856
A vulnerability in huggingface/transformers versions =5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the "savepretrained" methods of "PreTrainedTokenizerBase" and "ProcessorMixin", where keys from the "chattemplate" dictionary are used...
CVE-2026-68770
sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the importmoduleclass helper within sentencetransformers/util/misc.py, where the guard condition includes an 'or...
CVE-2026-1839
A vulnerability in the HuggingFace Transformers library, specifically in the "Trainer" class, allows for arbitrary code execution. The "loadrngstate" method in "src/transformers/trainer.py" at line 3059 calls "torch.load" without the "weightsonly=True" parameter. This issue affects all versions o...
CVE-2018-10368
An issue was discovered in WUZHI CMS 4.1.0. The "Extension Module - System Announcement" feature has Stored XSS via an announcement...
CVE-2026-56851
The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer...
CVE-2026-86289
A vulnerability was found in Ollama up to 0.31.1. This issue affects the function readGGUFV1String of the file fs/ggml/gguf.go of the component GGUF Decoder. Performing a manipulation results in integer overflow. The attack is possible to be carried out remotely. The exploit has been made public...
CVE-2026-41298
OpenClaw before 2026.4.2 fails to enforce write scopes on the POST /sessions/:sessionKey/kill endpoint in identity-bearing HTTP modes. Read-scoped callers can terminate running subagent sessions by sending requests to this endpoint, bypassing authorization controls...
CVE-2025-51602
mmstu.c in VideoLAN VLC media player before 3.0.22 allows an out-of-bounds read and denial of service via a crafted 0x01 response from an MMS server...
CVE-2020-13388
An exploitable vulnerability exists in the configuration-loading functionality of the jw.util package before 2.3 for Python. When loading a configuration with FromString or FromStream with YAML, one can execute arbitrary Python code, resulting in OS command execution, because safeload is not used...
CVE-2026-41611
Improper neutralization of script-related html tags in a web page basic xss in Visual Studio Code allows an unauthorized attacker to execute code locally...
CVE-2025-21264
Files or directories accessible to external parties in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...
CVE-2020-21831
A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read2004sectionhandles ../../src/decode.c:2637...
CVE-2019-16904
TeamPass 2.1.27.36 allows Stored XSS by setting a crafted password for an item in a common available folder or sharing the item with an admin. The crafted password is exploitable when viewing the change history of the item or tapping on the item...
CVE-2018-7206
An issue was discovered in Project Jupyter JupyterHub OAuthenticator 0.6.x before 0.6.2 and 0.7.x before 0.7.3. When using JupyterHub with GitLab group whitelisting for access control, group membership was not checked correctly, allowing members not in the whitelisted groups to create accounts on...
CVE-2012-6552
Unspecified vulnerability in admin/action.php in phpVMS 2.1.x before 2.1.935 has unknown impact and attack vectors...
CVE-2026-101043
pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand $VAR environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project's pnpm-workspace.yaml. Because the manifest is repository-controlled and the proxy keys were omitted from the...
CVE-2026-5241
A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. The issue arises because the "trustremotecode" parameter, intended to prevent remote code execution, ...
CVE-2026-44843
LangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.85 and 1.3.3, LangChain contains older runtime code paths that deserialize run inputs, run outputs, or other application-controlled payloads using overly broad object allowlists. These paths may call load with...
CVE-2026-41610
Improper neutralization of input during web page generation 'cross-site scripting' in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...
CVE-2026-8213
A vulnerability has been found in OSGeo gdal up to 3.13.0dev-4. Affected by this issue is the function GDSDfldsrch of the file frmts/hdf4/hdf-eos/GDapi.c of the component Grid File Handler. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit h...
CVE-2026-40087
LangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.84 and 1.2.28, LangChain's f-string prompt-template validation was incomplete in two respects. First, some prompt template classes accepted f-string templates and formatted them without enforcing the same...
CVE-2026-27148
Storybook is a frontend workshop for building user interface components and pages in isolation. Prior to versions 7.6.23, 8.6.17, 9.1.19, and 10.2.10, the WebSocket functionality in Storybook's dev server, used to create and update stories, is vulnerable to WebSocket hijacking. This vulnerability...
CVE-2025-6921
The huggingface/transformers library, versions prior to 4.53.0, is vulnerable to Regular Expression Denial of Service ReDoS in the AdamWeightDecay optimizer. The vulnerability arises from the douseweightdecay method, which processes user-controlled regular expressions in the includeinweightdecay...
CVE-2025-6638
A Regular Expression Denial of Service ReDoS vulnerability was discovered in the Hugging Face Transformers library, specifically affecting the MarianTokenizer's "removelanguagecode" method. This vulnerability is present in version 4.52.4 and has been fixed in version 4.53.0. The issue arises from...
CVE-2022-34128
The Cartography aka positions plugin before 6.0.1 for GLPI allows remote code execution via PHP code in the POST data to front/upload.php...
CVE-2022-20785
On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in HTML file parser of Clam AntiVirus ClamAV versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an...