412514 matches found
CVE-2026-69676: Authentication Bypass by Capture-replay
Authentication bypass by capture-replay in Windows Kerberos allows an authorized attacker to execute code over a network...
CVE-2026-46489: Improper Neutralization of Input During Web Page Generation
SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, the company logo upload feature accepts any file type without validation. An authenticated administrator can upload an SVG file containing embedded JavaScript. This script is base64-encoded and injected unescaped into eve...
CVE-2026-7258: Out-of-bounds Read
In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, some functions, including urldecode, pass signed char to ctype functions like isxdigit. On the systems with default signed char and optimized table-lookup ctype functions - such as NetBSD - this can...
CVE-2026-2303: Permissive List of Allowed Inputs
The mongo-go-driver repository contains CGo bindings for GSSAPI Kerberos authentication on Linux and macOS. The C wrapper implementation contains a heap out-of-bounds read vulnerability due to incorrect assumptions about string termination in the GSSAPI standard. Since GSSAPI buffers are not...
CVE-2023-23879: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in Nicolas Zeh PHP Execution plugin = 1.0.0 versions...
CVE-2020-24701: Improper Neutralization of Input During Web Page Generation
OX App Suite through 7.10.4 allows XSS via the app loading mechanism the PATHINFO to the /appsuite URI...
CVE-2015-8722: Improper Input Validation
epan/dissectors/packet-sctp.c in the SCTP dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate the frame pointer, which allows remote attackers to cause a denial of service NULL pointer dereference and application crash via a crafted packet...
CVE-2015-6254: Undefined Security Weakness
The 1 Service Provider SP and 2 Identity Provider IdP in PicketLink before 2.7.0 does not ensure that the Destination attribute in a Response element in a SAML assertion matches the location from which the message was received, which allows remote attackers to have unspecified impact via unknown...
CVE-2010-2075: Improper Input Validation
UnrealIRCd 3.2.8.1, as distributed on certain mirror sites from November 2009 through June 2010, contains an externally introduced modification Trojan Horse in the DEBUG3DOLOGSYSTEM macro, which allows remote attackers to execute arbitrary commands...
CVE-2010-2157: Undefined Security Weakness
Unspecified vulnerability in CA ARCserve Backup r11.5 SP4, r12.0 SP2, and r12.5 SP1 on Windows allows local users to obtain sensitive information via unknown vectors...
CVE-2006-3781: Undefined Security Weakness
Unspecified vulnerability in Sun Solaris 10 allows context-dependent attackers to cause a denial of service panic via unspecified vectors involving the event port API...
CVE-2026-102255: Server-Side Request Forgery (SSRF)
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf a...
CVE-2026-104393: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Stored XSS.This issue affects Happy Addons for Elementor: from n/a through 3.50.0...
CVE-2026-39783: Missing Authorization
Missing Authorization vulnerability in WP SYNTEX Polylang polylang allows Retrieve Embedded Sensitive Data.This issue affects Polylang: from n/a through 3.8.7...
CVE-2026-58841: Improper Privilege Management
In multiple functions of VirtualAudioControllerTest.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-104313: Improper Neutralization of Input During Web Page Generation
The WPC Estimated Delivery Date for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ruledata' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
CVE-2026-104019: Improper Neutralization of Special Elements used in an OS Command
OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution 2.x before 2.14.12, 3.x before 3.9.12, 4.0.x before 4.0.11, 4.1.x before 4.1.11, 4.2.x before 4.2.8, 4.3.x before 4.3.5, and 4.4.x before 4.4.3, as used by Amazon SageMaker Unified Studio, might...
CVE-2026-103534: Improper Access Control
A vulnerability was determined in David-Crty databasement up to 1.7.1. Affected is the function SnapshotPolicy.viewAny/SnapshotPolicy.view of the file /api/v1/snapshots of the component Snapshot Model. This manipulation causes improper access controls. Remote exploitation of the attack is possibl...
CVE-2026-103760: Uncontrolled Resource Consumption
Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated remote attackers to block the handshake daemon by never reading replies. Attackers can send a Metadata request to the handshake RPC port and stall SocketHandShakePlugin's single...
CVE-2026-103472: Allocation of Resources Without Limits or Throttling
restbed through 5.0.0 accepts WebSocket frames with declared payload lengths up to 2^63 bytes and buffers the payload without size limits in an unbounded stream buffer. Remote unauthenticated attackers can declare large frame sizes and stream payload data to exhaust server memory, causing denial ...
CVE-2026-53610: Improper Neutralization of Input During Web Page Generation
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, an attacker can craft a URL for a dashboard that reflects attacker-controlled markup without sufficient output encoding. A user who opens the crafted URL triggers reflected cross-site scripting in the dashboard. Th...
CVE-2026-97414: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8365-afe-pcm: fix possible NULL-pointer dereferences in mt8365afesuspend mt8365afesuspend allocates the register backup buffer with devmkcalloc, but does not check for allocation failure before using the returne...
CVE-2026-93543: Out-of-bounds Read
An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client...
CVE-2026-54461: Inefficient Regular Expression Complexity
Habitica is a habit tracker application that treats goals like a role-playing game. From 4.172.1 until 5.48.2, a query parameter on Habitica's /api/v3/groups/:groupId/members route is not sanitized before being interpreted as a regular expression. An authenticated caller can supply a...
CVE-2026-95625: Improper Validation of Integrity Check Value
The Tauri updater plugin verifies update binaries using minisign signatures, but the signature covers only the raw binary bytes. The update manifest -- which contains the version number, download URL, and signature -- is fetched over TLS but is never itself signed or authenticated. Because the on...
CVE-2026-95929: Improper Neutralization of Special Elements used in an SQL Command
A weakness has been identified in iFlytek astron-agent up to 1.0.7. Affected is an unknown function of the file console/backend/commons/src/main/resources/mapper/ChatBotMarketMapper.xml of the component getBotList API endpoint. Executing a manipulation of the argument sortDirection can lead to sq...
CVE-2026-93349: Improper Neutralization of Special Elements used in an OS Command
Frictionless before 5.19.1 contains an OS command injection vulnerability in the explore console command that allows an attacker who supplies a crafted Data Package descriptor to execute arbitrary operating system commands as the user who explores it. Attackers can place shell metacharacters in...
CVE-2026-95604: Missing Authorization
Unauthenticated Broken Access Control in Loops & Logic = 4.2.4 versions...
CVE-2026-94680: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in The Post Grid = 7.9.5 versions...
CVE-2026-94671: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in The Post Grid = 7.9.5 versions...
CVE-2026-86612: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The Ninja Tables WordPress plugin before 5.2.17 does not restrict shortcode expansion to administrator-authored table rows which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes executed on a public page, and to permanently break that page, by submitting ...
CVE-2026-87022: Improper Handling of Length Parameter Inconsistency
Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following...
CVE-2026-96654: Improper Neutralization of Encoded URI Schemes in a Web Page
Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters...
CVE-2026-82407: Improper Input Validation
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, core/kapp/validators/validators.go Register and the runtime validator update path accept a submitted BLSPublicKey without curve, prime-order subgroup, or nonzero validation. When a validator with a malformed ke...
CVE-2026-93836: Improper Neutralization of Input During Web Page Generation
The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qty' parameter in all versions up to, and including, 8.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
CVE-2026-82000: Server-Side Request Forgery (SSRF)
Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery SSRF vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user...
CVE-2026-18153: Use of a Broken or Risky Cryptographic Algorithm
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information and forge authentication tags due to the use of hard-coded cryptographic keys and initialization vectors...
CVE-2026-75638: Improper Input Validation
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in...
CVE-2026-76804: Improper Access Control
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loading path does not enforce the -file capability gate when resolving file: protocol templates referenced by a workflow. An untrusted unsigned workflow can therefore load a...
CVE-2026-87121: Out-of-bounds Write
lwIP TCP/IP Stack MQTT is vulnerable to an out-of-bounds write, which may allow an attacker to gain full code execution on the device...
CVE-2026-94504: Improper Neutralization of Input During Web Page Generation
Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An attacker can break out of the textarea with stored script. When an Administrator opens the attacker-known direct submission URL, the script runs in the...
CVE-2026-88408: Stack-based Buffer Overflow
FalkorDB Redis module v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the GetGroup function /ops/opaggregate.c. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted input...
CVE-2026-92574: Execution with Unnecessary Privileges
A vulnerability in CRI-O checkpoint restore allows a user who can create a pod from a malicious checkpointed container to bypass the destination Kubernetes security context. The restored process may retain credentials, Linux capabilities, nonewprivs, and seccomp state from the checkpoint instead ...
CVE-2026-75158: Exposure of Sensitive Information to an Unauthorized Actor
Apache Airflow's /assets/events API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is authorized to read. Any authenticated user holding asset-read access could therefore enumerate asset events — including the source Dag ID, task ID,...
CVE-2026-11716: Heap-based Buffer Overflow
IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code during queue manager startup due to improper validation of cluster migration data...
CVE-2026-11381: Heap-based Buffer Overflow
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to improper validation of message distribution list structures...
CVE-2026-75878: Improper Authentication
IBM Sterling File Gateway could allow a remote attacker to bypass authentication and obtain a fully authenticated session due to improper authentication via an unvalidated SSO header...
CVE-2026-86688: Session Fixation
Session Fixation vulnerability in team-alembic ashauthentication allows an attacker who can plant a session identifier in a victim's browser to hold an authenticated session once that victim signs in. AshAuthentication.Plug.Helpers.storeinsession/2 writes the authenticated subject into the existi...