414563 matches found
PT-2026-121559
Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an unbounded memory allocation in the wasmtime-wasi WASIp2 write-zeroes method of SinkOutputStream, the default stream used when stdout/stderr are not configured. A malicious WebAssembly guest can request huge...
PT-2026-121571
Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 contains a type confusion vulnerability because several Store APIs fail to validate that objects belong to the Store's Engine. Embedders mixing objects between Engines via Instance::new,...
PT-2026-121667
Improper neutralization of special elements used in a command 'command injection' in Azure Pipelines allows an unauthorized attacker to execute code over a network...
PT-2026-121643
No description provided...
PT-2026-121395
In EmberZNet 9.1.1 and earlier, a malformed Simple Desc req response can result in an out-of-bounds write potentially leading to remote code execution. This response must come from a device that has already joined the network, and the attacker must wait for a Simple Desc req before the attack can...
PT-2026-121633
No description provided...
PT-2026-121605
No description provided...
PT-2026-121275
The Link Library WordPress plugin before 7.9.6 does not sanitise and escape a link field before outputting it inside an attribute of a link preview, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks. The preview is generated without authentication a...
PT-2026-121598
No description provided...
PT-2026-121629
No description provided...
PT-2026-121630
No description provided...
PT-2026-121636
No description provided...
PT-2026-121635
No description provided...
PT-2026-121634
No description provided...
PT-2026-121618
No description provided...
PT-2026-121631
No description provided...
PT-2026-121617
No description provided...
PT-2026-121602
No description provided...
PT-2026-121606
No description provided...
PT-2026-121627
No description provided...
PT-2026-121628
No description provided...
PT-2026-121614
No description provided...
PT-2026-121615
No description provided...
PT-2026-121616
⚠️ A severe vulnerability was disclosed for HPE AOS-10 CVE-2026-79877 vuldb.com/vuln/425543 https://t.co/Px6RRJ7IGz...
PT-2026-121600
No description provided...
PT-2026-121622
No description provided...
PT-2026-121599
No description provided...
PT-2026-121620
No description provided...
PT-2026-121611
No description provided...
PT-2026-121621
No description provided...
PT-2026-121609
No description provided...
PT-2026-121610
No description provided...
PT-2026-121623
No description provided...
PT-2026-121624
No description provided...
PT-2026-121625
No description provided...
PT-2026-121607
No description provided...
PT-2026-121593
No description provided...
PT-2026-121595
No description provided...
PT-2026-121591
No description provided...
PT-2026-121596
No description provided...
PT-2026-121597
No description provided...
PT-2026-121645
No description provided...
PT-2026-121686
The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string within the firmware image, identical across all deployed devices. An attacker with access to the publicly distributed firmware can...
PT-2026-121399
In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an out-of-bounds write potentially leading to remote code execution. These messages must come from a device that has already joined the network. Only devices supporting the Price Cluster are impacted...
PT-2026-121276
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not verify that a user targeted through its student-enrolment feature has any relationship to the requesting instructor, allowing users with the Instructor role to overwrite the first name, last name and public display name ...
PT-2026-121347
NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by supplying an array-form 'id' parameter to /wp-json/notificationx/v1/notification/id. Attackers can pass id1 with crafted SQ...
PT-2026-121351
Penta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files via the name parameter of /webapi/file/transfer. Attackers can send GET requests with type=db backup and ../ sequences in name to read files like...
PT-2026-121295
Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via unsigned LogoutResponse messages. esaml:status code map/1 in src/esaml.erl maps any StatusCode value it does n...
PT-2026-121333
webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 and in version 6.0.0, when a proxy entry is configured to forward WebSockets, the server forwards non-HMR WebSocket upgrade requests to the proxy target without validating the Ho...
PT-2026-120930
Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests with the :scheme http pseudo-header over TLS on Go 1.27 builds to reach routers requiring client...