178210 matches found
CVE-2026-77763 JuiceFS Local Filestore Backend Joins Object Keys onto the Storage Root Without a Containment Check, Allowing Writes Outside the Configured Directory
The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived every operation's target from pathkey, which returned either filepath.Joind.root, key or filepath.Cleand.root + key with no check that the result stayed beneath the root. Put, Ge...
CVE-2026-77086 SiYuan before v3.7.4 Path Traversal via packageName
SiYuan before v3.7.4 fails to validate the packageName parameter in Bazaar install and uninstall endpoints, allowing authenticated administrators to perform path traversal via directory traversal sequences. Attackers with admin access can write arbitrary files to any location via install operatio...
CVE-2026-77686 Dolibarr Account card.php improper authorization
A weakness has been identified in Dolibarr up to 23.0.4. This affects an unknown part of the file htdocs/user/card.php of the component Account Handler. This manipulation of the argument ID causes improper authorization. The attack may be initiated remotely. The exploit has been made available to...
CVE-2026-14208 Local Privilege Escalation via Insecure DLL Permissions in Remote Utilities Host <=7.7.3.0
Remote Utilities Host =7.7.3.0 sets insecure ACLs on all DLL files in the installation directory C:\Program Files x86\Remote Utilities - Host, granting FULL CONTROL F to the built-in Everyone group BUILTIN\Everyone, S-1-1-0. A Windows service running as NT AUTHORITY\SYSTEM loads DLLs from this...
CVE-2026-59296 Micrometer StatsD and Logging meter registries line-protocol and log injection vulnerability
Using untrusted, non-normalized input as-is for metrics data such as metric names, tag keys, or tag values is a dangerous antipattern that general-purpose instrumentation should never perform. When such unsafe instrumentation is used, the application becomes vulnerable to injection and spoofing...
CVE-2026-77683 Comfast CF-N1-S mbox-config system command injection
A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function system of the file /cgi-bin/mbox-config?method=SET§ion=ntptimezone. The manipulation of the argument timestr results in command injection. The attack can be launched remotely. The exploit ha...
CVE-2026-77761 Cross-Document Parser State Contamination in misp-stix
A parser state isolation vulnerability in misp-stix could cause data from a previously processed STIX document to be retained and incorporated into the MISP event generated from a subsequent document when the same parser instance is reused. Several STIX 1 and STIX 2 parser components maintained...
CVE-2026-59323 Micrometer Tracing Brave Bridge W3C Baggage propagation DoS vulnerability
An application using Micrometer Tracing with W3C baggage propagation in the Brave bridge is vulnerable to denial of service DoS due to unbounded object allocation when extracting incoming baggage headers. Specifically, an application is vulnerable when all the following are true: The application...
CVE-2026-77755 Denial of Service in MISP-STIX Import via Malformed or Oversized STIX Documents in misp-stix library
A denial-of-service vulnerability was identified in misp-stix when processing attacker-controlled STIX 1 or STIX 2 documents. The STIX import code used sys.exit to handle several parsing and loading failures. Because SystemExit inherits from BaseException rather than Exception, these failures...
CVE-2026-47079 Round-trip Corruption via Improper Entity Escaping in xml_builder
Inappropriate Encoding for Output Context vulnerability in joshnuss xmlbuilder XmlBuilder module allows Content Spoofing, Cross-site Scripting. This vulnerability is associated with program files lib/xmlbuilder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2,...
CVE-2026-48590 Element and Attribute Names Injected Verbatim into XML Output in xml_builder
XML Injection vulnerability in joshnuss xmlbuilder XmlBuilder module allows Content Spoofing, XML Injection. This vulnerability is associated with program files lib/xmlbuilder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.element/1, XmlBuilder.element/2,...
CVE-2026-47080 CDATA Section Breakout via Unsanitised ]]> in xml_builder
XML Injection vulnerability in joshnuss xmlbuilder XmlBuilder module allows Content Spoofing, XML Injection. This vulnerability is associated with program files lib/xmlbuilder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.escape/1. The escape/1 clause for :cdata...
CVE-2026-77751 Path Traversal in MISP Object Template Resolution During STIX Import and Export in misp-stix library
A path traversal vulnerability existed in the handling of MISP object template names during STIX 2 import and MISP-to-STIX 2 export. MISP object names are passed to PyMISP's object-template resolution mechanism, which constructs a filesystem path by joining the configured MISP object-template...
CVE-2026-77681 CodeAstro Online Job Portal update-profile.php unrestricted upload
A vulnerability was identified in CodeAstro Online Job Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /users/update-profile.php. The manipulation of the argument Name leads to unrestricted upload. The attack can be initiated remotely. The exploit is publicly...
CVE-2026-47827 CVE-2026-47827 – BOSH CLI Powershell Injection
Command Injection in BOSH CLI tool on windows in Cloud Foundry allows a remote attacker to execute arbitrary shell commands via command injection vulnerabilities...
CVE-2026-77710 STIX2 Parser Confusion and Mass Assignment Allow Unauthorized MISP Attribute Metadata Injection in misp-stix library
A vulnerability in misp-stix could allow a crafted STIX document to influence security-sensitive MISP attribute metadata during import. The STIX import logic automatically selected between the internal MISP parser and the external STIX parser based on metadata contained in the STIX document itsel...
CVE-2026-63046 Apache InLong: Agent Installer — Command Injection to RCE via Default Credentials
Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability in Apache InLong. Agent Installer's ModuleManager executes arbitrary shell commands via ExcuteLinux.exeCmd with no filtering or whitelist validation. This issue affects Apache InLong: from 2.0.0 before...
CVE-2026-47359 Apache CloudStack: OS Command Injection due to unsanitized mount command
Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache CloudStack's NAS backup provider plugin. The addBackupRepository API available since 4.20.0.0 and updateBackupRepository API introduced in 4.22.0.0 accept unsanitized command options f...
CVE-2026-50112 Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates
SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets. The Secondary Storage VM will retrieve the data and persist it as a template file, which can later be downloaded through normal...
CVE-2026-50222 Apache CloudStack: Improper access control in Userdata reference APIs
Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs. Several userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachin...
CVE-2026-59085 Apache CloudStack: Server-Side Request Forgery (SSRF) vulnerability in webhook module
Server-Side Request Forgery SSRF vulnerability in Apache CloudStack's webhook module, exploitable via webhook delivery requests. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1....
CVE-2026-59655 Apache CloudStack: Unauthenticated OAuth provider client-secret disclosure
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth authentication plugin while listing OAuth providers. This issue affects Apache CloudStack: from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to...
CVE-2026-59657 Apache CloudStack: Sensitive Information Disclosure via Cleartext Storage in AsyncJob
Cleartext Storage of Sensitive Information vulnerability in Apache CloudStack with AsyncJob storage in the database. This issue affects Apache CloudStack: from 4.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, whi...
CVE-2026-59780 Apache CloudStack: LDAP provider configuration disclosure
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's LDAP authentication plugin while listing LDAP providers. LDAP configurations can be listed by any authenticated user with access to the listLdapConfigurations API. By default, this API is available to...
CVE-2026-59799 Apache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable Flow
Improper Privilege Management vulnerability in Apache CloudStack's Two-factor authentication plugin allowing bypass of the two-factor authentication disable flow. This issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to...
CVE-2026-61397 Apache CloudStack: OAuth2 Token Cross-Request Leak
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration. This issue affects Apache CloudStack: from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to...
CVE-2026-61398 Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in UI
Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Instance Reset Password functionality. This issue affects Apache CloudStack: from 4.15.1.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or...
CVE-2026-61399 Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI
Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Lock User Functionality. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later,...
CVE-2026-61400 Apache CloudStack: Get and Run Diagnostics Command Injection
Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in Apache CloudStack's run and get diagnostics functionality for the system VMs and virtual routers. An authenticated user holding the permissions required to invoke either getDiagnosticsData or...
CVE-2026-61422 Apache CloudStack: Authenticated pre-validation SSRF in registerTemplate
Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO registration functionality. When registering a template or ISO, CloudStack makes a live HTTP HEAD/GET call to determine file size for secondary storage usage-limit checks, and this happens before URL validatio...
CVE-2026-62440 Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulation
Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service CKS plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes. This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to versi...
CVE-2026-65613 Apache CloudStack: Webhook Deliveries Incorrect Access
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting deliveries. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to versio...
CVE-2026-66721 Apache CloudStack: Authorization issue with listHostTags for domain admins
Missing authorization issue for domain admins in CloudStack's host tags listing functionality. Domain Admins, by default, have permission to call the listHostTags API, but the API returns host tags for every host in the environment without domain scoping. It should instead be restricted to only t...
CVE-2026-66722 Apache CloudStack: ProjectRole & ProjectRolePermission authorization issue
Improper authorization for CRUD operations on Project Roles and Project Role permissions for domain admins in CloudStack. A Domain Admin can create, update, delete, and list project roles and project role permissions for projects in any domain, not just their own. The check only confirms the call...
CVE-2026-66797 Apache CloudStack: Unauthorised comment creation and disclosure
Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user...
CVE-2026-68745 Apache CloudStack: SAML2 Signature Validation Silently Skipped for Cert-less IdP
Certificate validation failures in SAML authentication in Apache CloudStack 4.20.3.0 and 4.22.1.0 on all platforms allow a malicious agent to forge a SAML response to the management server. The agent will have to spoof the ip address of the IdP or get an url of its own choosing registered in the...
CVE-2026-74866 @fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name
@fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence, so a lone carriage return or line feed embedded in a part header is not treated as a line break and is carried verbatim into t...
CVE-2026-19441 Unauthenticated API Allows Analytics Data Manipulation in IKAS Technology's Rush
Missing authentication for critical function vulnerability in IKAS Technology Inc. Rush allows Fake the Source of Data. This issue affects Rush: through 21082026. NOTE: The vendor was contacted and it was learned that the product is not supported...
CVE-2026-77264 Automation Web Platform <= 4.8.6 - Unauthenticated Authentication Bypass via 'otp_transient' Token Disclosure
The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 4.8.6. This is due to the handleemailotpreturn function returning the secret magic login token in the response t...
CVE-2026-73537
Cross-site scripting vulnerability exists in Miraikan Assist App. If this vulnerability is exploited, an arbitrary script may be executed in the browser component WebView running on the affected product, resulting in the displayed content being altered...
CVE-2026-16323 Authentication Bypass via Execution After Redirect in FuyaSoft's Architect Panel Web Management Panel
Execution after redirect EAR vulnerability in FuyaWeb Internet and Informatics Services ArchitectPanel Web Admin Panel allows Authentication Bypass. This issue affects ArchitectPanel Web Admin Panel: through 28072026...
CVE-2026-19435 Copy & Delete Posts < 1.5.6 - Authenticated Arbitrary Post Content and Password Disclosure
The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allowing users with a delegated role to read the content, metadata and passwords of posts they are not allowed to access, including other users' private and draft content...
CVE-2026-75796 AI Engine 2.8.0 - 3.6.0 - Admin+ Multisite Network Administrator Account Takeover via MCP User Tools
The AI Engine WordPress plugin before 3.6.1 does not verify that the requesting user is authorized to act on the targeted account before performing privileged user management operations, allowing users with the Administrator role on a Multisite sub-site to take over any account on the network,...
CVE-2026-19085 Copy & Delete Posts < 1.5.6 - Author+ Password-Protected Post Content Disclosure
The Duplicate Post WordPress plugin before 1.5.6 does not check that a user may read the content of a post before duplicating it, allowing users with a delegated role to republish another user's password-protected post as publicly readable...
CVE-2026-18781 Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Unauthenticated RCE via Control Character Filename Bypass
The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not validate the final name of an uploaded file after stripping characters from it, allowing unauthenticated users to defeat its file type restrictions and execute arbitrary code on the server...
CVE-2026-16576 Dokan < 5.0.14 - Shop Manager+ Arbitrary Plugin Installation/Activation via REST API
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the Dokan: AI Powered WooCommerce Multivendor...
CVE-2026-16959 Media Library Assistant < 3.40 - Author+ SQL Injection via mla_search_connector
The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role to perform SQL injection...
CVE-2026-14601 Link Whisper < 0.9.7 - Editor+ SQL Injection via domain Parameter
The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with the Editor role or above to perform SQL injection attacks...
CVE-2026-16577 Dokan < 5.0.14 - Vendor+ Reverse Withdrawal Ledger Manipulation via Client-Supplied Amount
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not validate a client-supplied payment amount against the vendor's actual outstanding balance when recording a reverse-withdrawal payment, allowing a vendor to credit their reverse-withdrawal...
CVE-2026-16575 Dokan < 5.0.14 - Unauthenticated Commission Settings Disclosure via Store Categories REST Endpoint
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not restrict access to per-vendor commission configuration returned by one of its unauthenticated store REST endpoints, allowing any unauthenticated user to disclose a vendor's commission type...