396856 matches found
Red Hat: CVE-2026-77874: org.hibernate/hibernate-core: Hibernate ORM: SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end databa...
CVE-2026-95604: Missing Authorization
Unauthenticated Broken Access Control in Loops & Logic = 4.2.4 versions...
CVE-2026-91789: Out-of-bounds Write
Foxit PDF Editor/Reader’s U3D/GIF texture decoding path contained insufficient validation of image dimensions and related size information. Under certain conditions, this could lead to an incorrectly sized memory allocation and a subsequent out-of-bounds write during pixel processing, potentially...
CVE-2026-77762: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from...
CVE-2026-86247: Race Condition within a Thread
Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be...
Debian: CVE-2026-75131: network-manager-l2tp -- security update
NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains a privilege escalation vulnerability that allows local users with permission to create VPN connections to execute arbitrary code as root by injecting pppd options through a crafted VPN username. Attackers can embed a double-quote...
CVE-2026-90899: Exposure of Sensitive Information to an Unauthorized Actor
Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0 - The checkout.searchGuestUser endpoint allowed querying guest checkout records solely by supplying an email address. The server returned complete shipping details full...
CVE-2026-91815: Out-of-bounds Write
Foxit PDF Editor/Reader does not perform sufficient verification of the JPEG2000 image metadata in the PDF file, which leads to out-of-bounds write in the heap buffer during decoding, potentially causing the program to crash and introducing the risk of arbitrary code execution...
CVE-2026-94176: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Mang Board WP = 2.4.1 versions...
CVE-2026-61834: Improperly Controlled Modification of Dynamically-Determined Object Attributes
scim-patch is a library for applying SCIM patch operations. Prior to 0.9.2, navigate reads inherited properties and assign uses prototype-chain membership checks while resolving attacker-controlled SCIM PATCH paths. A path or one of the dotted value keys beginning with an inherited property such ...
CVE-2026-95625: Improper Validation of Integrity Check Value
The Tauri updater plugin verifies update binaries using minisign signatures, but the signature covers only the raw binary bytes. The update manifest -- which contains the version number, download URL, and signature -- is fetched over TLS but is never itself signed or authenticated. Because the on...
CVE-2026-95601: Improper Neutralization of Special Elements used in an SQL Command
Unauthenticated SQL Injection in Product Filter by WBW = 3.1.7 versions...
CVE-2026-53978: Undefined Security Weakness
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2026-95590: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in Tainacan = 1.2.0 versions...
CVE-2026-93526: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Event Tickets = 5.29.4 versions...
CVE-2026-93618: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock. Jetimpex Inc. JetTricks allows Stored XSS. This issue affects JetTricks: from n/a through 2.0.1...
CVE-2026-82407: Improper Input Validation
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, core/kapp/validators/validators.go Register and the runtime validator update path accept a submitted BLSPublicKey without curve, prime-order subgroup, or nonzero validation. When a validator with a malformed ke...
CVE-2026-80342: Authorization Bypass Through User-Controlled Key
The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.27 does not verify that a PayPal order supplied in a payment request belongs to the WooCommerce order being paid unless that PayPal order has already been completed, allowing unauthenticated attackers to have another buyer's...
CVE-2026-95600: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Unauthenticated Sensitive Data Exposure in TrustedLogin Connector = 2.0.3 versions...
CVE-2026-83555: Missing Authorization
The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a subscriber's subscription status, allowing unauthenticated users to force-unsubscribe or force-confirm an arbitrary subscriber whose email address they know...
CVE-2026-90951: Incorrect Authorization
The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user, allowing someone who holds another member's in-flight payment identifier to delete that member's checkout state...
CVE-2026-96257: Stack-based Buffer Overflow
A flaw has been found in Fast FAC1203R Gigabit Edition 2.0.4. Affected by this issue is the function copymsgelement of the component Device Discovery Service. Executing a manipulation can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been published and...
CVE-2026-92730: Improper Neutralization of Input During Web Page Generation
LimeSurvey Community Edition 7.0.14 contains a reflected cross-site scripting vulnerability on the administrative survey-participant CSV import result page...
CVE-2026-91810: Out-of-bounds Read
A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF image masks. Inconsistent image metadata may cause incorrect alpha-channel processing during rendering, resulting in an out-of-bounds read and application crash...
CVE-2026-96654: Improper Neutralization of Encoded URI Schemes in a Web Page
Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters...
CVE-2026-96826: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Shazzad Hossain Khan W4 Post List allows Blind SQL Injection. This issue affects W4 Post List: from n/a through 3.0.6...
CVE-2026-73586: Insufficient Session Expiration
Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Insufficient Session Expiration vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Elevation of privileges, Protection mechanism...
CVE-2026-95846: Missing Authorization
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks used for a normal PUBLISH. A client can configure a Will for a topic that the client is not permitted to...
CVE-2026-53979: Undefined Security Weakness
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2026-6794: Double Free
IBM Concert 1.0.0 through 3.0.0 has a double free vulnerability that exists due to incorrect memory management. A local attacker can exploit this flaw to corrupt heap memory and execute arbitrary code in the context of the affected process...
CVE-2026-84026: Exposure of Sensitive Information to an Unauthorized Actor
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not restrict access to a REST endpoint that returns user records, allowing unauthenticated attackers to read registered users' private contact details...
CVE-2026-95592: Authorization Bypass Through User-Controlled Key
Unauthenticated Insecure Direct Object References IDOR in Team = 6.0.0 versions...
CVE-2026-96556: Improper Authorization
A flaw has been found in Neethuharii CafeManagement. Affected by this vulnerability is the function addcashier of the file AddCashierCode.php. Executing a manipulation of the argument uname/pass/role/status can lead to improper authorization. The attack may be performed from remote. The exploit h...
CVE-2026-91814: Improper Verification of Cryptographic Signature
A signature validation vulnerability exists in Foxit PDF Editor/Reader’s handling of incrementally updated PDF documents. Changes to visible document content may not invalidate the existing signature, allowing attackers to alter signed content and potentially carry out content spoofing while the...
CVE-2026-18180: Improper Neutralization of Special Elements used in an SQL Command
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to SQL injection...
CVE-2026-96655: Server-Side Request Forgery (SSRF)
Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter...
CVE-2026-93511: Authentication Bypass by Spoofing
The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment and subscription notifications, allowing unauthenticated attackers to forge payment confirmations and subscription-cancellation events against any order whose transaction id the...
CVE-2026-96455: Missing Authentication for Critical Function
The Reachy Mini daemon exposes an HTTP API for managing the robot. Its app installation endpoint, POST /apps/install in src/reachymini/daemon/app/routers/apps.py, has no authentication. The handler's only dependency is Dependsgetappmanager, which just hands back the manager object from applicatio...
CVE-2026-85724: Incorrect Authorization
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an MQTT topic filter. A client that uses...
CVE-2026-19438: Improper Limitation of a Pathname to a Restricted Directory
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in ABB Mint Workbench I. This issue affects Mint Workbench I: through 5876...
CVE-2026-79310: Improper Control of Generation of Code
webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to an...
CVE-2026-94684: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in Ocean Extra = 2.6.1 versions...
CVE-2026-71462: Observable Response Discrepancy
StringListPathField.tointernalvalue calls os.path.exists on unbounded user-supplied paths. 200 vs 400 response reveals existence of arbitrary absolute paths on the controller-web pod. Tenant superuser can confirm /etc/tower/SECRETKEY, k8s service-account token, receptor sockets, ConfigMap mount...
CVE-2026-95522: Improper Neutralization of Special Elements used in an SQL Command
Shop manager SQL Injection in Easy Digital Downloads = 3.7.0 versions...
CVE-2026-96757: Improper Control of Generation of Code
orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. Attackers can inject JavaScript through crafted media-type keys in OpenAPI specifications that executes when generated fetch operations or mock resolve...
CVE-2026-95513: Missing Authorization
Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita = 4.6.0 versions...
CVE-2026-96552: Use of a One-Way Hash without a Salt
A vulnerability was identified in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. The affected element is the function MD5.getMD5 of the file ssmpro/src/main/java/cn/sfturing/utils/MD5.java of the component User Password Handler. The manipulation leads to one-way hash without...
CVE-2026-15027: Improper Neutralization of Special Elements used in an OS Command
CGServiSign developed by Changing has a OS Command Injection vulnerability. Unauthenticated remote attackers can induce victims to visit a malicious web page and inject arbitrary OS commands through the local service interface, resulting in command execution on the victim's local computer...
CVE-2026-94118: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in Premium Blocks – Gutenberg Blocks for WordPress = 2.3.17 versions...