198569 matches found
CVE-2026-101300 Server-Side Request Forgery in Wegow PDF export
Server-Side Request Forgery SSRF reported in the ticket sales chart PDF export functionality of Wegow. According to the report, an authenticated user with a promoter account can manipulate the parameter of the POST request generated by selecting Download PDF. The content is processed by the...
CVE-2026-15575 Sensitive Information Disclosure Due to Enabled Debug Mode in Production in SFM Software's Costifier
Active debug code vulnerability in SFM Software Technologies Inc. Costifier allows Exploit Non-Production Interfaces. This issue affects Costifier: through 2026-10-16. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...
CVE-2026-15219 IDOR in SFM Software's Costifier
Authorization bypass through User-Controlled key vulnerability in SFM Software Technologies Inc. Costifier allows Exploitation of Trusted Identifiers. This issue affects Costifier: through 2026-10-16. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...
CVE-2026-111472 SQL injection in TSG Profleet
An SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to retrieve, create, update and delete data from the database by sending a GET request using the ‘Identificación’ parameter of the ‘/cgi-bin/index.php’ endpoint...
CVE-2026-14177 User Enumeration via Password Reset in IKAS Technology Inc.'s ikas E-Commerce Infrastructure
Observable response discrepancy vulnerability in IKAS Technology Inc. Ikas E-Commerce Infrastructure allows Account Footprinting. This issue affects ikas E-Commerce Infrastructure: through 2026-07-13...
CVE-2026-18799 Mattermost Server fails to restrict Slack import account binding, allowing team admins to forge posts as existing users
Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to restrict Slack import account binding to system administrator-initiated imports which allows an authenticated attacker with team admin privileges to force-add existing Mattermost users to their team a...
CVE-2026-16251 Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering
Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to limit the size of remote image responses buffered in memory during local image proxy direct fetches, which allows a remote attacker to cause memory exhaustion on the server via a crafted oversized ima...
CVE-2026-18256 Private team metadata disclosure via the team search API
Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to properly restrict private teams from public team search results, which allows an authenticated user without permission to list private teams to disclose the ID, name, and display name of private teams...
CVE-2026-110914
Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-110915
Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-110917
Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. Chromium security severity: High...
CVE-2026-110918
Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. Chromium security severity: High...
CVE-2026-110920
Memory corruption in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-110921
Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-110913
Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-110919
Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-110922
Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Critical...
CVE-2026-109468 ASP.NET Core Denial of Service Vulnerability
...
CVE-2026-108454 Microsoft Office PowerPoint Information Disclosure Vulnerability
...
CVE-2026-108455 Microsoft Office PowerPoint Information Disclosure Vulnerability
...
CVE-2026-108452 Microsoft Office SharePoint Remote Code Execution Vulnerability
...
CVE-2026-108453 Microsoft Office PowerPoint Information Disclosure Vulnerability
...
CVE-2026-108450 Microsoft Office Word Remote Code Execution Vulnerability
...
CVE-2026-108451 Microsoft Office Word Remote Code Execution Vulnerability
...
CVE-2026-108449 Microsoft Office Word Remote Code Execution Vulnerability
...
CVE-2026-108448 Microsoft Office Outlook Remote Code Execution Vulnerability
...
CVE-2026-108446 Microsoft Office Excel Remote Code Execution Vulnerability
...
CVE-2026-108447 Microsoft Office Word Remote Code Execution Vulnerability
...
CVE-2026-108445 Microsoft Office Word Remote Code Execution Vulnerability
...
CVE-2026-108444 Microsoft Office Remote Code Execution Vulnerability
...
CVE-2026-108443 Microsoft Office Word Remote Code Execution Vulnerability
...
CVE-2026-108442 Microsoft Office Word Remote Code Execution Vulnerability
...
CVE-2026-108441 Microsoft Office Word Remote Code Execution Vulnerability
...
CVE-2026-108440 Microsoft Office Word Remote Code Execution Vulnerability
...
CVE-2026-108439 Microsoft Office Word Remote Code Execution Vulnerability
...
CVE-2026-108437 Microsoft Office Word Remote Code Execution Vulnerability
...
CVE-2026-108438 Microsoft Office Word Information Disclosure Vulnerability
...
CVE-2026-108435 Microsoft Office Word Information Disclosure Vulnerability
...
CVE-2026-108436 Microsoft Office Word Information Disclosure Vulnerability
...
CVE-2026-108433 Microsoft Office Word Security Feature Bypass Vulnerability
...
CVE-2026-108434 Microsoft Office Word Information Disclosure Vulnerability
...
CVE-2026-108432 Microsoft Office Word Remote Code Execution Vulnerability
...
CVE-2026-108431 Microsoft Office Word Remote Code Execution Vulnerability
...
CVE-2026-108430 Microsoft Office Word Remote Code Execution Vulnerability
...
CVE-2026-108428 Microsoft Office Word Remote Code Execution Vulnerability
...
CVE-2026-108429 Microsoft Office Word Remote Code Execution Vulnerability
...
CVE-2026-108427 Microsoft Office Word Remote Code Execution Vulnerability
...
CVE-2026-108426 Microsoft Office Word Remote Code Execution Vulnerability
...
CVE-2026-104198 ZoneMinder failed token handling bypasses web authentication
ZoneMinder is a free, open source closed-circuit television software application. In versions 1.34.0 through 1.36.38, the web interface mishandles failed token authentication in web/includes/auth.php. validateToken returns false when a token is malformed or has an invalid signature, but the calle...
CVE-2026-45165 Idira Secrets Manager (Self-Hosted): Improper Authorization in REST API
An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy branch. Under specific circumstances, an attacker could potentially leverage this to retrieve unauthorized secrets, alter administrative access...