414110 matches found
CVE-2026-76663: Stack-based Buffer Overflow
A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption that may result in DoS...
CVE-2026-110812: Deserialization of Untrusted Data
Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. To remediate this issue, users not enrolled in...
CVE-2026-103509: Insufficient Granularity of Access Control
P4 Search formerly Helix Search returns stored credentials in cleartext through its configuration API to users with administrative privileges on the connected P4 Server, allowing privilege escalation. This affects 2026.4.2 and earlier and is fixed in 2026.4.3...
CVE-2026-101306: Improper Check for Dropped Privileges
SCMRIGHTS file descriptor passing did not preserve FDRESOLVEBENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has received a directory file descriptor from another jail can use...
CVE-2026-101310: Buffer Over-read
The HDA audio device model did not check for zero-length Buffer Descriptor List BDL entries when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields were also subject to modification by the guest after validation. A malicious gue...
CVE-2026-109692: Missing Authorization
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8...
CVE-2026-97712: Missing Authorization
Sonatype Nexus Repository 3 allows a user that holds the role create or role update permission to grant roles and privileges that the account does not hold. This can give the user more access than intended, up to full administrative access...
CVE-2026-53882: Improper Link Resolution Before File Access
An improper link resolution before file access 'link following' vulnerability has been reported to affect Virtualization Station. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in...
CVE-2026-111223: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root via the loginbanner field. Attackers can submit a single-line banner containing '' to escape the unquoted strongswan.con...
CVE-2026-111215: Improper Neutralization of Special Elements used in an OS Command
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent interface name. Attackers with limited Wireless Edit or Interface Assignments privileges can submit values like ath0;...
CVE-2026-110917: Improper Restriction of Operations within the Bounds of a Memory Buffer
Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. Chromium security severity: High...
CVE-2026-110918: Improper Restriction of Operations within the Bounds of a Memory Buffer
Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. Chromium security severity: High...
CVE-2026-110920: Improper Restriction of Operations within the Bounds of a Memory Buffer
Memory corruption in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-110921: Use After Free
Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-110922: Use After Free
Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Critical...
CVE-2026-107172: Undefined Security Weakness
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2026-111369: Incorrect Authorization
ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any course member, including students, to modify lessons. Authenticated students can supply arbitrary lesson ids to change titles and stored HTML content or delet...
CVE-2026-111234: External Control of File Name or Path
SimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed servers to read server files by supplying file:// URLs in redirects or autodiscovery links. Attackers can return a Location header or feed link pointing to a file:// path, causing filegetcontents to read...
CVE-2026-77466: Improper Input Validation
Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee hides the Omnipay Dummy test provider from the checkout options in production through OmnipayFactory::getsupportedproviders, but CreateSessionRequest validates only that the submitted provider is an OmnipayProviderType an...
CVE-2026-100349: NULL Pointer Dereference
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.146.0, openapi3filter.ValidateResponse passes a nil response header schema to decodeValue when an OpenAPI document declares the header with content instead of schema. The document passes validation, but every response validation f...
CVE-2026-100347: Improper Input Validation
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationHandler uses the routers/legacy router, which passes an unsupported or non-canonical HTTP method for an existing static path to openapi3.PathItem.GetOperation. The default branch of GetOperation...
CVE-2026-100353: NULL Pointer Dereference
kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a nil-items guard for legal OpenAPI 3.1 array schemas. An unauthenticated remote client can trigger a deterministic...
CVE-2026-110810: Out-of-bounds Read
A vulnerability was detected in ggml-org whisper.cpp up to 1.9.4. This affects the function whispermodelload of the file src/whisper.cpp of the component Model Loader. Performing a manipulation of the argument ttype results in out-of-bounds read. The attack must be initiated from a local position...
CVE-2026-79824: Path Traversal: '\dir\..\filename'
A directory traversal vulnerability in HPE NonStop Python 3.x could allow attackers to overwrite arbitrary files via a .. dot dot sequence in filenames in a TAR archive...
CVE-2026-102465: Allocation of Resources Without Limits or Throttling
In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the Vert.x Redis client RESP parser pre-allocates arrays to a length declared by the server without enforcing an upper bound. A malicious or compromised Redis server, or an attacker in a man-in-the-middle...
CVE-2026-94134: Key Exchange without Entity Authentication
The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless hostkey is configured or nohostkeycheck is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position...
CVE-2026-75505: Missing Authorization
EspoCRM is an open source customer relationship management application. Prior to 10.0.2, an authenticated user with mass-update permission can supply a known attachment identifier to the mass-update functionality. The mass-update processor duplicates the attachment without checking whether the...
CVE-2026-76184: Exposure of Sensitive Information to an Unauthorized Actor
In Eclipse Jetty, HttpClient may receive a redirect of the form: /secure/../evil If an attacker is able to control the redirects, then HttpClient matches authentication credentials against /secure rather than normalizing the path to /evil, and will therefore follow the redirect sending the...
CVE-2026-106147: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
In Progress® Kendo® UI for jQuery releases starting with R1 2020 and prior to 2026.3.1015, the ListBox default item template renders the bound dataTextField value as raw HTML without encoding. An attacker who can modify the bound data can supply HTML containing event handlers that execute...
CVE-2026-77460: Authorization Bypass Through User-Controlled Key
EspoCRM is an open source customer relationship management application. Prior to 10.0.3, a user with email-template edit access and mass-email sending access can reference restricted record fields in a template because the renderer stops filtering those fields when per-user ACL application is...
CVE-2026-73799: Stack-based Buffer Overflow
A security vulnerability in HPE NonStop SNMP Trap Multiplexer may cause memory corruption...
CVE-2026-111231: Incorrect Authorization
Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because configrestore and configinstall ignore the 'User - Config: Deny Config Write' privilege. Attackers holding page privileges for servicesacb.php,...
CVE-2026-106701: Undefined Security Weakness
ELADMIN v2.7 and before is vulnerable to Cross Site Scripting XSS via the component WebSocketServer, SpringSecurityConfig, deploy.vue...
CVE-2026-58391: Improper Neutralization of Input During Web Page Generation
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, Firewall Rules and NAT views place stored category names and alias descriptions into HTML title attributes in filterrule.volt and natrule.volt without quote-safe encoding. The response layer uses ENTNOQUOTES, so ...
CVE-2026-77468: Allocation of Resources Without Limits or Throttling
Lychee is a free, open-source photo-management tool. Prior to 7.7.0, GET /docs/api exposes the Scramble-generated OpenAPI documentation configured by config/scramble.php to unauthenticated callers after installation, with observed response size and latency suggesting that the schema is regenerate...
CVE-2026-76664: Out-of-bounds Read
A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read/write operations...
CVE-2026-76660: Improper Input Validation
A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds write that can corrupt buffer data...
CVE-2026-77470: Improper Input Validation
Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additionaldata array and CheckoutService::preparePurchaseParameters merges it after server-computed purchase parameters. Because later...
CVE-2026-16436: Weak Password Recovery Mechanism for Forgotten Password
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI...
CVE-2026-107416: Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through 6.5.2...
CVE-2026-41541: UNIX Symbolic Link (Symlink) Following
An unix symbolic link symlink following vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Qsync...
CVE-2026-34007: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later...
CVE-2026-106031: Improper Access Control
The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones...
CVE-2026-110904: Incorrect Authorization
ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 call...
CVE-2026-77931: Undefined Security Weakness
MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by embedding malicious instructions in untrusted content processed through tools like browsewebpage, searchweb, and torrent metadata parsers, which then get passed to the...
CVE-2026-111126: Out-of-bounds Read
catdoc through 0.95 contains an out-of-bounds read vulnerability in the MULRK record handler of processitem in src/xlsparse.c that allows attackers to read past the static rec buffer via a crafted end column. Attackers can supply a crafted .xls workbook or BIFF stream with a large endcol to xls2c...
CVE-2026-41544: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: QcalAgent 1.1.10 and...
CVE-2026-101309: Concurrent Execution using Shared Resource with Improper Synchronization
The xHCI USB 3 device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block TRB fields were loaded without protection against concurrent modification by the guest. This race condition could be...
CVE-2026-45451: Improper Authentication
: Improper Authentication vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only B10 / C10 – UniLogic versions prior to 1.41.329...