CVE-2025-34047: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability exists in the Leadsec SSL VPN formerly Lenovo NetGuard, allowing unauthenticated attackers to read arbitrary files on the underlying system via the ostype parameter in the /vpn/user/download/client endpoint. This flaw arises from insufficient input sanitation,...

CVE-2025-48059: Inefficient Regular Expression Complexity

PowSyBl Power System Blocks is a framework to build power system oriented software. In com.powsybl:powsybl-iidm-criteria versions 6.3.0 to before 6.7.2 and com.powsybl:powsybl-contingency-api versions 5.0.0 to before 6.3.0, there is a a potential polynomial Regular Expression Denial of Service...

CVE-2025-48877: Insecure Automated Optimizations

Discourse is an open-source discussion platform. Prior to version 3.4.4 of the stable branch, version 3.5.0.beta5 of the beta branch, and version 3.5.0.beta6-dev of the tests-passed branch, Codepen is present in the default allowediframes site setting, and it can potentially auto-run arbitrary JS...

CVE-2025-1049: Heap-based Buffer Overflow

Sonos Era 300 Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Sonos Era 300 speakers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the...

CVE-2021-33602: Undefined Security Weakness

A vulnerability affecting the F-Secure Antivirus engine was discovered when the engine tries to unpack a zip archive LZW decompression method, and this can crash the scanning engine. The vulnerability can be exploited remotely by an attacker. A successful attack will result in Denial-of-Service o...

CVE-2021-29958: Missing Authorization

When a download was initiated, the client did not check whether it was in normal or private browsing mode, which led to private mode cookies being shared in normal browsing mode. This vulnerability affects Firefox for iOS 34...

CVE-2019-4921: Undefined Security Weakness

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none...

CVE-2015-4837: Undefined Security Weakness

Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Utility/Security...

CVE-2015-2468: Improper Restriction of Operations within the Bounds of a Memory Buffer

Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office for Mac 2016, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, Word Web Apps 2010 SP2, and Office Web Apps Server...

CVE-2015-1964: Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service daemon crash via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1925, CVE-2015-1929, CVE-2015-1930, CVE-2015-1948,...

CVE-2006-3834: Undefined Security Weakness

EJ3 TOPo 2.2.178 includes the password in cleartext in the ID field to index.php, which allows context-dependent attackers to obtain entry passwords via log files, referrers, or other vectors...

CVE-2006-2784: Undefined Security Weakness

The PLUGINSPAGE functionality in Mozilla Firefox before 1.5.0.4 allows remote user-assisted attackers to execute privileged code by tricking a user into installing missing plugins and selecting the "Manual Install" button, then using nested javascript: URLs. NOTE: the manual install button is use...

CVE-2005-4317: Undefined Security Weakness

Limbo CMS 1.0.4.2 and earlier, with registerglobals off, does not protect the $SERVER variable from external modification, which allows remote attackers to use the SERVERREMOTEADDR parameter to 1 conduct cross-site scripting XSS attacks in the stats module or 2 execute arbitrary code via an eval...

CVE-2026-98385: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: sched/cache: Decouple schedcachegroup from mm to fix UAF Currently the sched cache grouping is by mm and the scheduling statistics schedcachestat lives in the mm structure. This ties the life cycle of scheduling stats with mm. In...

CVE-2026-109308: Improper Control of Generation of Code

Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request parameter in AppController::actionCacheUpdates to UpdatesModel without Component::cleanseConfig, allowing behavior and event-handler injection. Authenticated control panel users with the performUpdates...

CVE-2026-76464: Improper Restriction of Operations within the Bounds of a Memory Buffer

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The...

CVE-2026-106219: External Control of File Name or Path

In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server...

CVE-2026-104385: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in Groundhogg = 4.8.3 versions...

CVE-2026-39798: Missing Authorization

Unauthenticated Settings Change in TrueBooker = 1.2.9 versions...

CVE-2026-97343: Improper Authentication

The Burst Statistics – Simple WordPress Analytics Google Analytics Alternative plugin for WordPress is vulnerable to Improper Authentication leading to Account Persistence in all versions up to, and including, 3.7.1. This is due to the maybeloadshareddashboard handler issuing a genuine WordPress...

CVE-2026-92974: Improper Neutralization of Input During Web Page Generation

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'thumburl' parameter in all versions up to, and including, 1.8.46 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-94594: Insertion of Sensitive Information into Log File

Armatura One's message broker logs client connection credentials and the associated password in plain text during normal operation. Any party with read access to this log, or to a backup or support bundle that includes it, can obtain the logged credential...

CVE-2026-102511: Improper Verification of Source of a Communication Channel

Improper Verification of Source of a Communication Channel in the ADS discovery of the Go implementation of Apache PLC4X PLC4Go allows an attacker able to send UDP datagrams to the discovering host to redirect subsequent connections to an arbitrary, attacker-chosen address. The discovery result's...

CVE-2026-76504: Improper Handling of URL Encoding (Hex Encoding)

A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request,...

CVE-2026-35189: Allocation of Resources Without Limits or Throttling

Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of...

CVE-2026-102875: Improper Limitation of a Pathname to a Restricted Directory

VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal sequences to write arbitrary files with VLC user privileges, enabling code...

CVE-2026-93355: Weak Authentication

LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any existing user by exploiting an email-based fallback lookup in the JWT authentication flow without verifying the emailverified claim...

CVE-2026-18415: Out-of-bounds Write

ieee802154send in subsys/net/l2/ieee802154/ieee802154.c copies the outgoing packet into a single fixed 125-byte transmit buffer txframebufpool, sized IEEE802154MTU. In builds with CONFIGNETL2IEEE802154FRAGMENT enabled the default whenever CONFIGNET6LO is set, the branch taken when 6LoWPAN...

CVE-2026-100908: Stack-based Buffer Overflow

A vulnerability has been found in Eyeplus 57.0.0.0308. This affects an unknown function of the component p2pcam HTTP Parser. Such manipulation leads to stack-based buffer overflow. The attack may be performed from remote. The exploit has been disclosed to the public and may be used...

CVE-2026-100847: Improper Neutralization of Special Elements used in an SQL Command

AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of AbstractSearchableListAction.php. Attackers can inject arbitrary DQL expressions through the sortOrder parameter to extract sensitive database information including user credentials and station settin...

CVE-2026-100717: Improper Neutralization of CRLF Sequences

froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl rejects carriage return and line feed characters only in the path, query and fragment components returned by parseurl, and never inspects the userinfo user:pass@ components. This is an incomplete fix f...

CVE-2026-56730: Missing Authorization

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, an authorization bypass vulnerability was found that allows an authenticated agent to read knowledge base answer content they should not be able to access. The vulnerable GraphQL mutation is meant to transform a...

CVE-2026-98041: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Don't predict JMP32 pointer vs zero comparisons Consider the following program: r1 = mapvalue; / low 32 bits are zero at runtime / r6 = 0xdead000000000000; if w1 != 0 goto l1; l0: r1 += r6; r2 = u64 r1 + 0; exit; l1: r6 = 0;...

CVE-2026-100388: Missing Authorization

RustDesk versions before 1.5.0 fail to properly validate file transfer permissions on incoming file clipboard messages in the Cliprdr message handler on Linux and macOS. Authenticated remote peers with disabled file transfer permissions can place files onto the host clipboard and retrieve copied...

CVE-2026-97228: Improper Neutralization of Special Elements in Data Query Logic

Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component getexportstatus in src/exportmanager.py, whereby the exportid value — an unvalidated MCP tool argument reaching the function via the checkrapid7exportstatus and...

CVE-2026-61825: Improper Neutralization of Input During Web Page Generation

code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in SharpEditorFormField: attacker-controlled content bearing the data-html-content attribute can bypass HTML...

CVE-2026-51994: Server-Side Request Forgery (SSRF)

mcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request Forgery SSRF via the resourcemetadata URL extracted from a remote MCP server's WWW-Authenticate header...

CVE-2026-97056: Insufficient Session Expiration

SigNoz versions from v0.98.0 up to but not including v0.143.0, when configured to use the opaque session tokenizer which was not the default before v0.143.0, do not revoke a user's existing login sessions when the user's password is reset with a reset token UpdatePasswordByResetPasswordToken,...

CVE-2026-93249: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: spi: amlogic-spisg: Make sure clkinitdata is fully initialized The clkinitdata structure contains several mutually-exclusive members for different methods to specify the possible parents of a clock, prompting drivers to initializ...

CVE-2026-93275: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/pt: Fix stop/start with no update If pteventstop is called without PERFEFUPDATE flag, then perfauxoutputend is not called. A subsequent call to pteventstart will call perfauxoutputbegin again which violates the rul...

CVE-2026-96773: URL Redirection to Untrusted Site

A weakness has been identified in Intelliants Subrion CMS up to 4.2.1. This vulnerability affects the function iaUsers::authorize of the file front/login.php of the component Login Page. This manipulation of the argument $SERVER'HTTPREFERER' causes open redirect. The attack is possible to be...

CVE-2026-63498: Improper Neutralization of Input During Web Page Generation

Snipe-IT is an IT asset/license management system. Prior to 8.7.0, the uploaded-files API endpoint GET /api/v1/objecttype/id/files/fileid allows an authenticated user with file-management access to upload XML and XSLT attachments and request them with the inline=true parameter. The...

CVE-2026-97055: Initialization of a Resource with an Insecure Default

SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret tokenizer::jwt::secret, set via SIGNOZTOKENIZERJWTSECRET or the deprecated SIGNOZJWTSECRET to an empty string, and Config.Validate does not reject the empty value, so a deployment that does not configure a secret starts ...

CVE-2026-88382: Allocation of Resources Without Limits or Throttling

hiredis commit 29ea279 post-v1.5.0 contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser...

CVE-2026-94684: Undefined Security Weakness

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. False positive detection...

CVE-2026-94679: Missing Authorization

Subscriber Broken Access Control in Fluent Support = 2.3.2 versions...

CVE-2026-85475: Improper Neutralization of Directives in Statically Saved Code

A flaw was found in the Ansible Automation Platform automation controller. The external logging rsyslog configuration is generated by interpolating user-controlled settings — LOGAGGREGATORHOST, LOGAGGREGATORMAXDISKUSAGEPATH and LOGAGGREGATORRSYSLOGDERRORLOGFILE — into an rsyslog RainerScript conf...

CVE-2026-91776: Uncontrolled Resource Consumption

TypeDeserializerBase.findDeserializer in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfouse = Id.NAME, defaultImpl = ..., every distinct unrecognized type ID...

CVE-2026-84683: Improper Neutralization of Input During Web Page Generation

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of job, ad hoc command, project update, and inventory update standard output escapes HTML metacharacters but does not remove ANSI terminal escape sequences before conversion to HTML. An ANSI OSC 8...

CVE-2026-82409: Improper Encoding or Escaping of Output

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, indexer/common.go serializedDataForUpdateAccounts places the attacker-controlled acc.Name value into an Elasticsearch bulk JSON and NDJSON request without escaping it. The SetAccountName transaction accepts val...