414110 matches found
CVE-2026-79713: Inconsistent Interpretation of HTTP Requests
The Breeze Cache WordPress plugin before 2.5.15 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served from...
CVE-2026-93454: Improper Neutralization of Input During Web Page Generation
Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plugin. Authenticated users with payment-term create permission can submit arbitrary JavaScript to the payment-terms endpoint, which persists to the database and executes in browse...
CVE-2026-61817: Improper Neutralization of Special Elements used in an SQL Command
pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, runmaintenance, showpartitions, showpartitioninfo, undopartition, and partitiondatatime interpolate the writable partconfig.timedncoder text value without identifier quoting into dynamic SQL. A role...
CVE-2026-81480: Stack-based Buffer Overflow
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Stack-based Buffer Overflow vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution...
CVE-2026-54520: Improper Limitation of a Pathname to a Restricted Directory
AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, the executeStep file-step implementation in backend/src/agents/executor.js passes the user-controlled step.path value through path.resolve with process.cwd and then us...
CVE-2026-87829: Authorization Bypass Through User-Controlled Key
The Checkout Field Manager Checkout Manager for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users...
CVE-2026-70009: Improper Limitation of a Pathname to a Restricted Directory
Improper limitation of a pathname to a restricted directory 'path traversal' in Azure Arc allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-55946: Improper Neutralization of Special Elements used in a Command
Ai command injection in Microsoft Copilot allows an unauthorized attacker to disclose information over a network...
CVE-2026-15688: Incorrect Implementation of Authentication Algorithm
Incorrect Implementation of Authentication Algorithm Vulnerability in Mitsubishi Electric GX Works3 and Motion Control Setting allows a local attacker to successfully authenticate even with an invalid block password by executing the affected product and modifying part of the executable module in...
CVE-2026-93083: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Unwind TX receiver mailbox setup failure mailboxchansetup can request an additional unidirectional TX receiver channel after successfully acquiring the primary channel. If that second request fails, the functio...
CVE-2026-20332: Improper Access Control
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has conducted a comprehensive internal securi...
CVE-2026-85469: Reliance on Insufficiently Trustworthy Component
A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream Noelware/docker-manifest-action used in the release workflow, which is pinned to a mutable branch. This allows the attacker to inject arbitrary code, leading to the exfiltration of sensitive...
CVE-2026-76424: Relative Path Traversal
A vulnerability in the REST API of Cisco ISE could allow an authenticated, remote attacker to upload or copy arbitrary files on an affected device. This vulnerability is due to insufficient validation in file operations. An attacker could exploit this vulnerability by uploading a file with a...
CVE-2026-89865: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers The FRU and I2C bsg handlers stage their transfer in a DMAPOOLSIZE 256-byte bounce buffer obtained from dmapoolalloc, which does not zero the allocation. They initialize...
CVE-2026-76423: Authentication Bypass by Spoofing
A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to gain administrative access to an affected device. This vulnerability is due to the REST API web service being exposed with insufficient authorization checks. An attacker could exploit...
CVE-2026-91750: Server-Side Request Forgery (SSRF)
WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when downloading documents from user-supplied URLs. Authenticated attackers can bypass initial SSRF validation by supplying a public URL that redirects to internal networ...
CVE-2026-45794: Deserialization of Untrusted Data
Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the anonymous Push Notification SNS callback handled by SnsMessageResource falls back to a CTS predicate blob after a messageId expires from the in-memory dispatcher, treats top-level blob keys as Java class names fo...
CVE-2026-46623: Unverified Password Change
Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the OAuth2 authentication module updates an existing local account with profile attributes that can include userPassword and inetUserStatus, rewriting the password to the username and reactivating disabled accounts...
CVE-2026-83432: Improper Access Control
Vulnerability in the Oracle Depot Repair product of Oracle E-Business Suite component: Estimate and Actual Charges. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Depot...
CVE-2026-76703: Buffer Copy without Checking Size of Input
A buffer overflow vulnerability exists in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways that could allow an authenticated attacker with administrative access to cause a denial of service. Successful exploitation could allow an attacker to disrupt system...
CVE-2026-83173: Improper Access Control
Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite component: Documents. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle One-to-One...
CVE-2026-56831: Improper Input Validation
Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.0, the /cpanel/discounts administrative interface accepts negative fixedamount discount values, persists them in shdiscounts, and passes them through vendor/shopper/cart/src/Discounts/DiscountCalculator.php and...
CVE-2023-50459: Incorrect Authorization
An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. It fails to check access permissions for the edit user component. An authenticated frontend user can exploit this to either edit data of various frontend users or delete various frontend user accounts...
CVE-2026-73195: Improper Encoding or Escaping of Output
Improper Encoding or Escaping of Output vulnerability in Apache Syncope. Authenticated users can store a spreadsheet formula payload in one of their own plain attributes. When such users are included in a CSV export and the generated CSV file is opened by a spreadsheet application, the formula ma...
CVE-2026-33970: NULL Pointer Dereference
An issue was discovered in NR RRC and L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 1680, W920, W930, W1000, and Modem 5410. In the 5G baseband, a NULL Pointer Dereference occurs when processing a malformed RR...
CVE-2026-84513: Insertion of Sensitive Information into Log File
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. A malicious application may be able to determine...
CVE-2023-24286: sgt-puzzles -- security update
Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the game description parameter...
CVE-2026-82792: Improper Neutralization of Input During Web Page Generation
Cross-site scripting vulnerability exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...
CVE-2023-29377: Relative Path Traversal
An issue was discovered in Softing OPC UA C++ SDK through 6.20 and Softing Secure Integration Server through 1.22. By using FileType renames, it is possible to bypass limitations on assignment of a directory path to FileDirectory OPC UA objects and a file path to File OPC UA objects...
CVE-2026-86898: Improper Neutralization of Input During Web Page Generation
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Opening a maliciously crafted webarchive file may lead to universal cross-site scripting...
CVE-2026-90489: Improper Neutralization of Input During Web Page Generation
A vulnerability was identified in Xuxueli xxl-job up to 3.5.0. This vulnerability affects unknown code of the file /jobinfo/insert. Such manipulation of the argument name/author leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used...
CVE-2026-77807: Improper Limitation of a Pathname to a Restricted Directory
The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 11.0.4 via the username Parameter. This makes it possible for unauthenticated attackers to read the conten...
CVE-2026-90461: Improper Restriction of Communication Channel to Intended Endpoints
OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTPS Basic Authentication...
CVE-2026-82925: Deserialization of Untrusted Data
The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or...
CVE-2026-78573: Use of Default Credentials
IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials...
CVE-2026-49362: Missing Authentication for Critical Function
An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential denial of service. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users...
CVE-2023-54355: Improper Verification of Cryptographic Signature
PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1 elliptic curve. Attackers can provide LoginPackets with keys using different curves or non-EC key types to pass login verification but trigger an uncaught exceptio...
CVE-2026-11363: Deserialization of Untrusted Data
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and...
CVE-2026-86768: Improper Input Validation
Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with checkout permissions to bind live inventory to trashed targets. Attackers can submit POST requests to hardware, component, or consumable checkout endpoints with soft-deleted use...
CVE-2026-87037: Missing Authorization
Tanium addressed an improper access controls vulnerability in Comply...
CVE-2026-81330: Cleartext Transmission of Sensitive Information
The C6 ear camera transmits live video to the EarVision Android application over unencrypted UDP streams. The application manifest permits cleartext traffic, and captured network traffic contains reconstructable JPEG or WEBP video frames transmitted over UDP. An attacker within local wireless ran...
CVE-2026-87030: Improper Limitation of a Pathname to a Restricted Directory
Tanium addressed a path traversal vulnerability in Comply...
CVE-2026-69621: Heap-based Buffer Overflow
Heap-based buffer overflow in Windows Fax Service allows an authorized attacker to elevate privileges locally...
CVE-2026-69785: Untrusted Search Path
Untrusted search path in Windows Smart Card allows an authorized attacker to elevate privileges locally...
CVE-2026-70583: Heap-based Buffer Overflow
Heap-based buffer overflow in Windows Core Messaging allows an authorized attacker to elevate privileges locally...
CVE-2026-77908: Improper Control of Generation of Code
Improper control of generation of code 'code injection' in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network...
CVE-2026-69518: Heap-based Buffer Overflow
Heap-based buffer overflow in Windows Remote Desktop allows an unauthorized attacker to execute code over a network...
CVE-2026-69528: Missing Authentication for Critical Function
Missing authentication for critical function in Windows Shell allows an authorized attacker to elevate privileges locally...
CVE-2026-69607: Use After Free
Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network...
CVE-2026-74859: Improper Limitation of a Pathname to a Restricted Directory
The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can write files outside /.themes by using ../ path traversal, absolute paths, or symlink entries...