414110 matches found
CVE-2026-95671: Missing Authorization
In MISP, the CollectionsController add method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST. However, the underlying CRUDComponent::add method persists data on both POST and PUT requests. As a result, an authenticated user...
CVE-2026-77620: Improper Handling of Highly Compressed Data (Data Amplification)
Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source feeds each decompressed frame back into its decoder without limiting nested compression depth. An unauthenticated remote peer that can reach the default 0.0.0.0:5044 listener can send many nest...
NotepadPlusPlus: CVE-2026-85288: Improper Neutralization of Special Elements used in an OS Command
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ incompletely enforces shortcuts.xml HMAC validation because WMMACRODLGRUNMACRO, the Run a Macro Multiple Times entry point, calls macroPlayback without the validation used by command. A tampered shortcuts.xml macro...
CVE-2026-95500: Unrestricted Upload of File with Dangerous Type
A vulnerability has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. Impacted is the function fileputcontents of the file codeEditor.php of the component Save Handler. The manipulation of the argument filename/content leads to unrestricted upload. The attack is possible to b...
CVE-2026-80146: Stack-based Buffer Overflow
Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a stack-based buffer overflow vulnerability that allows authenticated attackers to potentially execute arbitrary code by exploiting an...
CVE-2026-18131: Improper Neutralization of Input During Web Page Generation
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute arbitrary JavaScript in an authenticated user's browser due to improper neutralization of HTML input...
CVE-2026-82009: Improper Neutralization of Special Elements used in an SQL Command
Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to...
CVE-2026-88339: NULL Pointer Dereference
A NULL pointer dereference vulnerability exists in the gfsgvrmlfieldclone function of GPAC 2d7da22e 26.08-DEV. The vulnerability occurs when cloning a PROTO default SFImage field with a NULL source pointer. An attacker can provide a specially crafted input file that triggers the condition,...
CVE-2026-92882: Insufficiently Protected Credentials
Insufficiently protected credentials in the host and folder configuration endpoints of the REST API in Checkmk 2.5.0p15, 2.4.0p38, 2.3.0p51 and 2.2.0 EOL allows an authenticated user who may view a host's configuration to read stored SNMP community strings, SNMPv3 auth and privacy pass phrases an...
CVE-2026-86062: Improper Neutralization of Input During Web Page Generation
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, lightragwebui/src/components/retrieval/ChatMessage.tsx renders answer and thinking content with react-markdown, rehypeRaw, and skipHtml=false without an HTML sanitizer. An attacker who can add a document can store r...
CVE-2026-77271: Improper Limitation of a Pathname to a Restricted Directory
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, validatesafepath defaults its base directory to os.getcwd, and affected Confluence attachment call sites omit basedir, allowing attacker-selected writes within the working directory...
CVE-2026-77248: Improper Limitation of a Pathname to a Restricted Directory
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the streamable HTTP transport accepts requests without a user identity and falls back to operator credentials, while uploadattachment accepts an unrestricted filepath. An...
CVE-2026-75689: Improper Neutralization of Input During Web Page Generation
Adobe Connect is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field,...
CVE-2026-16468: Improper Neutralization of Special Elements used in an OS Command
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection...
CVE-2026-18156: Missing Authorization
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to bypass security controls by forging user identities due to improper authorization...
CVE-2026-95828: Session Fixation
A vulnerability was determined in Mstfakts College-Management-System. This affects the function sessionstart of the file Front-end/server.php of the component Authentication. Executing a manipulation can lead to session fixiation. It is possible to launch the attack remotely. The exploit has been...
CVE-2026-75728: Incorrect Authorization
Adobe Campaign Classic ACC is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction...
CVE-2026-90462: Improper Handling of Insufficient Permissions or Privileges
A flaw was found in SSSD. When configured with the LDAP access provider and ldapaccessorder including ppolicy or lockout, a fail-open condition in the LDAP ppolicy access check can occur if a user lookup returns zero results. This can incorrectly return success and cache an allow decision,...
CVE-2026-89139: Improper Neutralization of Special Elements used in an OS Command
Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose function is to launch a worker by running a command on the machine hosting the Worker Service. The program name and the argument vector that...
CVE-2026-88467: Generation of Error Message Containing Sensitive Information
CRMEB Knowledge-Paid System crmebzzffclass 1.4.4 has a backend verification function that returns the wrong type of value, causing errors and leaking sensitive information...
CVE-2026-78847: Improper Neutralization of Directives in Dynamically Evaluated Code
An issue in gray-matter All versions verified on 4.0.3 allows the JavaScript engine in lib/engines.js using eval to parse front matter when language is js/javascript.This allows arbitrary code execution...
CVE-2026-94572: Improper Control of Generation of Code
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tlsciphers field for control characters. The value is written verbatim into the HAProxy configuration generated on the amphora, and thus an authenticated project member who owns a TLS-enabled lo...
CVE-2026-94138: Improper Neutralization of Special Elements used in a Command
A security flaw has been discovered in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. This impacts an unknown function of the file /sendorder.cgi?parameter=delexpmac. The manipulation of the argument mac results in command injection. The attack may be launched remotely. T...
CVE-2026-94368: Improper Verification of Cryptographic Signature
A flaw was found in the signature verification logic of noobaa-core, the core component of the NooBaa Multicloud Object Gateway. The issue occurs when the service processes S3 presigned URLs using Signature Version 4 SigV4. Due to improper validation, the service fails to reject requests containi...
CVE-2026-94413: Exposure of Sensitive Information to an Unauthorized Actor
jshERP through 3.6 fails to redact password hashes in the /user/info endpoint, allowing authenticated users to retrieve unsalted MD5 password digests for any user. Attackers can request arbitrary user information by supplying user IDs to obtain password hashes usable for offline cracking or direc...
CVE-2026-94210: Improper Neutralization of Input During Web Page Generation
A flaw has been found in Hyve5 Leantime up to 3.9.8. Affected by this vulnerability is the function getAllGrouped of the file app/Domain/Tickets/Services/Tickets.php of the component Kanban Board. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. Th...
CVE-2026-87858: Reliance on Untrusted Inputs in a Security Decision
Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only write permission in a single namespace could attach a completion callback whose URL host matched the configured callback address allowlist,...
CVE-2026-94152: Authorization Bypass Through User-Controlled Key
A security vulnerability has been detected in Omega Solution FBP Fulfillment by People 2025. This impacts an unknown function of the file /user/ of the component User Profile API. The manipulation of the argument ID leads to authorization bypass. Remote exploitation of the attack is possible. The...
CVE-2026-94216: Improper Neutralization of CRLF Sequences in HTTP Headers
A vulnerability was determined in ST Engineering iDirect iDX and Evo iDX. This vulnerability affects unknown code of the file /authorize of the component HTTP Request Handler. Executing a manipulation of the argument Success can lead to http response splitting. It is possible to launch the attack...
CVE-2026-91164: Improper Access Control
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.23.0 until 0.27.3, HTTP API token authentication resolves ConfigProvider::validateapitoken into RequestAuthorization::UserToken without enforcing the owning user's allowedipranges against the trusted client address in...
CVE-2026-94488: Improper Neutralization of Input During Web Page Generation
Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. The first fixed stable version is 7.0.1. This occurs in button.text.toUtf8 in exportoutputhtml.cpp. Exploitation cannot occur unless HTML export was used by a victim. However, the exploit payload can be exported if a message were...
CVE-2026-84990: Exposure of Sensitive Information to an Unauthorized Actor
ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/v2/get/system/configurations/listavailablebackups.lua and scripts/lua/rest/v2/get/system/configurations/downloadbackup.lua allow any authenticated non-admin user to list and download...
CVE-2026-92425: Authorization Bypass Through User-Controlled Key
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation checks on several of its host-management operations, allowing users who hold its own administrator-assigned custom role to read, modify and permanently delete...
CVE-2026-18442: Improper Neutralization of Special Elements used in an SQL Command
The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wcfmmpuserlocationlng' parameter in all versions up to, and including, 3.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2026-93870: Cross-Site Request Forgery (CSRF)
Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the ratings plugin AJAX handler, allowing attackers to forge ratings on behalf of authenticated users. Attackers can craft malicious pages that auto-submit POST requests to modify stored rating data when visited by logged-in users...
CVE-2026-61551: Uncontrolled Recursion
Icinga 2 is an open source monitoring system. Prior to 2.14.9, 2.15.4, and 2.16.2, parsing deeply nested JSON can exhaust the call stack because nesting depth is not bounded. The affected JSON parsing paths are reachable by unauthenticated network clients through the Icinga 2 service on TCP port...
CVE-2026-20323: Improper Certificate Validation
A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure FMC Software and Cisco Secure FTD Software could allow an unauthenticated, adjacent attacker to impersonate the peer device and obtain access at the level of the manager role, which is equivalent to root. This...
CVE-2026-89026: Use of Hard-coded Cryptographic Key
The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers c...
CVE-2026-87270: Improper Privilege Management
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle V...
CVE-2026-90840: Improper Authentication
A vulnerability was identified in PHPGurukul Blood Donor Management System 1.0. Affected is the function construct of the file /application/controllers/admin/Dashboard.php of the component Admin Controllers. The manipulation leads to improper authentication. The attack can be initiated remotely...
CVE-2026-91985: Exposure of Sensitive Information to an Unauthorized Actor
Vikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share read endpoints, allowing read-only members to obtain the share's secret credential. Attackers can exchange the disclosed hash for a link-share JWT at the share's permission level to escalate...
CVE-2026-55591: Server-Side Request Forgery (SSRF)
Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.28.0, makeRemoteRequest in src/serverroutes.ts accepted attacker-controlled host, port, useTLS, and selfsignedcert parameters from the testSignalKConnection, requestAccess, and checkAccessRequest endpoints...
CVE-2026-13275: Improper Restriction of XML External Entity Reference
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 Managed File Transfer could allow an authenticated attacker to read arbitrary files or perform...
CVE-2026-87090: Incorrect Authorization
Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog node-write path that may allow an authenticated attacker to delete another node's catalog registration and take over its node identity. An attacker with a token granting node-write permission on any single node...
CVE-2026-0310: Out-of-bounds Write
A buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web or dataplane interface to cause a denial of service DoS condition on VM-Series firewalls or execute arbitrary co...
CVE-2026-15417: Divide By Zero
In the silabser.sys Windows 8 driver for CP210x devices, a local unprivileged user can use incorrect driver settings to cause a kernel crash...
CVE-2026-88032: Use After Free
A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation is still using them when the operation is cancelled. A party able to cause such an operation to be cancelled may cause the...
CVE-2026-69495: Heap-based Buffer Overflow
Heap-based buffer overflow in Windows Event Logging Service allows an unauthorized attacker to execute code over a network...