413310 matches found
CVE-2026-113390
A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue is the function sub182B0 of the file /cgi-bin/mainfunction.cgi of the component CGI Interface. This manipulation of the argument usefile/usescript/option causes os command injection. Remote exploitation of th...
CVE-2026-113392
A vulnerability was found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This vulnerability affects unknown code of the file /cgi-bin/mainfunction.cgi of the component Apmupload. Performing a manipulation of the argument action results in path traversal. The attack is possible to be carried out...
CVE-2026-113399
Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1...
CVE-2026-113391
A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function uploadlangs of the file /cgi-bin/mainfunction.cgi of the component Upload Endpoint. Such manipulation leads to command injection. The attack can be executed remotely. The exploit has been disclose...
CVE-2026-105941
The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire...
CVE-2026-14933
Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent taking part ...
CVE-2026-18205
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Ticimax Informatics Technologies Inc. Ticimax E-Commerce Platform allows Reflected XSS. This issue affects Ticimax E-Commerce Platform: through 2026-09-02...
CVE-2026-113385
A vulnerability has been found in LeeDrOiD Labs Shortcutter 2 App 9.0.48 on Android. This issue affects the function Class.forName of the file ToggleGeneric.java. The manipulation of the argument Class leads to improper export of android application components. Local access is required to approac...
CVE-2026-113389
A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this vulnerability is the function settable of the file /cgi-bin/mainfunction.cgi of the component CGI Process. The manipulation of the argument sectiontype results in command injection. The attack may be launche...
CVE-2026-113495
A flaw was found in cockpit-machines. Red Hat Subscription Management RHSM authentication tokens are passed as command-line arguments to background helper processes during image retrieval operations. A local, unprivileged attacker on a system permitting cross-user process inspection can view thes...
CVE-2026-113496
A flaw was found in cockpit-machines. When saving Virtual Network Computing VNC console settings, the configured password is passed directly as a command-line argument to an underlying system utility. A local unprivileged attacker on a host that allows cross-user process inspection could read the...
CVE-2026-113583
Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by crafting malicious alt text or URL values in an HTML email's external image tag when ALLOWEXTERNALIMAGESOURCES is enabled. Attackers can send ...
CVE-2026-113388
A security flaw has been discovered in opensource-socialnetwork up to 9.11/10.1. This affects the function input of the file actions/administrator/cache/dynamic.php of the component Cache Settings. Performing a manipulation of the argument host/port/username/password/type/status results in code...
CVE-2026-105311
The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters.credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets RBAC, reads the victim-namespace KafkaUse...
CVE-2026-105312
A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on a...
CVE-2026-105949
Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethodstrue. The servlet routes requests using Path.ofpathInfo.getFileName, which strips all leading segments and...
CVE-2026-9589
Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren't...
CVE-2026-113356
DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText that passes draft file contents to unserialize without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating...
CVE-2026-113382
A security vulnerability has been detected in arizu-id fast-tunnel 1.0.0. Affected by this issue is the function ZipArchive::extractTo of the file backend/apiplugins.php of the component Plugin Installer. Such manipulation of the argument pluginfile leads to unrestricted upload. The attack may be...
CVE-2026-113357
@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive resul...
CVE-2026-113358
LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the filer/download and filer/display routes. Attackers can supply arbitrary disk names and paths to FileController to retrieve...
CVE-2026-113383
A vulnerability was detected in Optimal IdM OptimalCloud 5.0. This affects an unknown part of the file /v5.0/webapps/pages/public/Login. Performing a manipulation of the argument tz results in cross site scripting. Remote exploitation of the attack is possible. The vendor was contacted early abou...
CVE-2026-113384
A flaw has been found in Optimal IdM OptimalCloud 5.0. This vulnerability affects unknown code of the file /v5.0/social. Executing a manipulation of the argument state can lead to open redirect. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not...
CVE-2026-113349
OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent and onDeleteEvent that allows authenticated users to modify or delete other users' calendar events. Attackers with EDIT or DELETE access can supply arbitrary eventID values to alter or remove any user...
CVE-2026-113351
libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XMLParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XMLERRORNOMEMORY until it is...
CVE-2026-113353
LearnPress before 4.4.10 contains a missing authorization vulnerability in the admincourseeditor, adminquizeditor and adminquestioneditor lp-ajax actions, allowing instructors to modify other instructors' content. Authenticated instructors can reuse their own generic editor nonce with another...
CVE-2026-113354
Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of /api/system/files/content. Attackers can supply absolute paths to read /etc/shadow, /etc/passwd, git .git/config credentials, an...
CVE-2026-113355
Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject JavaScript by crafting video-embed links in Help Center articles. Attackers can use angle-bracket link destinations with double quotes to break out of the unescaped iframe src...
CVE-2026-113350
react-admin before 5.15.5 contains a stored cross-site scripting vulnerability that allows attackers to inject scripts by storing javascript: URIs in record fields rendered by UrlField and FileField. Attackers who can influence URL-type backend fields can execute JavaScript in an administrator's...
CVE-2026-113352
uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending absolute or ../ file names to victims with auto-accept enabled. Attackers can overwrite shell startup files or plant crafted .ftinfo resume records that ftfindresumeable loads,...
CVE-2026-112783
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and ajax/editActivity.php that allows READ-level users to edit and delete activity entries. Authenticated attackers can supply an arbitrary activityID via GET or POST to modify or delete activity and...
CVE-2026-112785
OpenCATS before 0.10.0 contains a missing authorization vulnerability that allows READ-level users to create, rename, delete, and populate saved lists via AJAX endpoints. Authenticated attackers can send requests to newList.php, editListName.php, deleteList.php, or addToLists.php with any...
CVE-2026-112787
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest that allows authenticated users to view EEO demographic reports without the canSeeEEOInfo permission. Attackers can invoke the customizeEEOReport and generateEEOReportPreview actions to view aggregat...
CVE-2026-112784
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/testEmailSettings.php that allows any authenticated user to send mail through the configured SMTP relay. Read-level users can supply testEmailAddress and fromAddress parameters to send the fixed test message to any...
CVE-2026-112786
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ImportUI::handleRequest that allows low-privileged authenticated users to roll back data imports. Attackers with READ-level access can request the import module's revert action with an importID to mass-delete imported...
CVE-2026-108089
UNSUPPORTED WHEN ASSIGNED Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon. An unauthenticated user could gain access to diagnostic interfaces, including triggering of cache, exposure of verbose debug logging and profile information. This...
CVE-2026-108086
UNSUPPORTED WHEN ASSIGNED Improper restriction of recursive entity references in DTDs 'XML entity expansion' vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. XEE in the fp: form processor could lead to SSRF, including exposing files from the server to an untrusted...
CVE-2026-108088
UNSUPPORTED WHEN ASSIGNED Use of cache containing sensitive information vulnerability in Apache Cocoon. When using the cache on a multi-user application, cached values for one user could be used when serving content for other users. This issue affects Apache Cocoon: all versions. As this project ...
CVE-2026-108062
Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service...
CVE-2026-108087
UNSUPPORTED WHEN ASSIGNED Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. Missing input sanitation would allow arbitrary SQL injection through the SQL processor or sql:/esql:...
CVE-2026-107597
PIA's token verification verifytoken in pia/oidc.py fetches the OIDC discovery document of an allowlisted issuer and then follows the jwksuri contained in that response without parsing it as a URL, comparing it against the approved issuer's origin, or requiring HTTPS — the only check is that the...
CVE-2026-85267
A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an unauthenticated attacker to hijack an active Cloud Shell session and exfiltrate the user's OAuth access token using a cross-origin WebSocket request. This vulnerability was patched...
CVE-2026-43851
A path traversal vulnerability could allow an authenticated attacker to read arbitrary files on the system...
CVE-2026-43852
A vulnerability could allow an authenticated attacker to write files to arbitrary locations on the system...
CVE-2026-43854
A vulnerability could allow an attacker with access to an encrypted project file to retrieve administrator credentials for EdgeLink-enabled devices...
CVE-2026-43856
A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated attacker to achieve arbitrary code execution via a path longer than 1024 bytes...
CVE-2026-43853
A vulnerability could allow an attacker to send a crafted message to trigger an assertion fault, causing the service to crash...
CVE-2026-43855
A heap-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution...