401902 matches found
CVE-2026-96543
An out-of-bounds heap write flaw exists in the GIMP PVR image loader . When processing a crafted non-square PVR texture, the pvr_decode_twiddle() function fails to perform bounds-checking on the destination offset, allowing attacker-controlled pixel data to be written beyond the allocated heap bu...
CVE-2026-96512
A flaw exists in sudo where rules using NOTBEFORE or NOTAFTER time-based restrictions, without the trailing 'Z' timezone indicator, rely on the TZ environment variable. Because sudo is a setuid-root program, an unprivileged local user can manipulate the TZ variable to shift the authorization wind...
CVE-2026-19599
ZohoCorp ManageEngine OpManager MSP versions 12.8.709 and below were vulnerable to a Remote Code Execution vulnerability in the Notification Profile module...
CVE-2026-75825
ZohoCorp ManageEngine OpManager versions 12.8.710 and below are affected by an Authentication Bypass vulnerability when the Application Manager Plugin is enabled. Exploitation of this flaw could allow an attacker to bypass security controls. No specific root cause, exploit details, or remediation...
CVE-2026-86247
Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be...
CVE-2026-76978
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below are susceptible to a Command Injection vulnerability within the Diagnose Settings feature. Successful exploitation could allow an attacker to execute arbitrary commands on the affected system. Exploitation details a...
CVE-2026-86246
The Apache Tomcat Native library is vulnerable to an initialization of a resource with an insecure default vulnerability. The software enables insecure options by default, specifically including ALLOW_CLIENT_RENEGOTIATION , NO_EXTENDED_MASTER_SECRET , IGNORE_UNEXPECTED_EOF , and ALLOW_NO_DHE_KEX ...
CVE-2026-86243
A buffer over-read vulnerability exists in Apache Tomcat Native during the TLS handshake . This flaw allows a malicious user to trigger a Denial of Service (DoS) by causing a JVM crash . Affected versions include 2.0.0 through 2.0.15 and 1.3.0 through 1.3.8 , as well as potentially earlier unsupp...
CVE-2026-76979
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to an XML Injection vulnerability in the Rule Tracking Compare Policies feature...
CVE-2026-68490
A flaw in the CalDAV and CardDAV service of cPanel & WHM version 120 and later allows a local user on the server to read calendar events and contacts belonging to other accounts. This vulnerability occurs because the service improperly handles permissions for these shared data points. Remediation...
CVE-2026-87899
A flaw in the CalDAV and CardDAV services of cPanel & WHM (version 120 and later) allows a logged-in account holder to execute code as root , potentially leading to full server control. The vulnerability is present on shared servers where any customer with an account could potentially exploit it....
CVE-2026-87900
A flaw in the WP Toolkit plugin, used for managing WordPress sites on cPanel, allows a logged-in account holder to change databases belonging to other accounts. The vulnerability exists in how the plugin processes commands for database creation. This issue affects WP Toolkit version 6.11.2-10794 ...
CVE-2026-84091
The SUMIT Payment Gateway for WooCommerce WordPress plugin (versions before 4.0.0 ) is vulnerable to an Unauthenticated Payment Confirmation Forgery . The root cause is a failure to verify payment notifications with the payment provider before marking orders as paid. This allows unauthenticated u...
CVE-2026-76980
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below are affected by a Data Exposure vulnerability within the Firewall Analyzer syslog collector . This vulnerability allows for high confidentiality impact from an adjacent network vector with low attack complexity and ...
CVE-2026-77112
A Server-Side Request Forgery (SSRF) vulnerability exists in the Weoll platform developed by Global IT Informatics Technology Services Inc. This flaw allows an attacker to perform SSRF attacks, which can lead to JWT Token Disclosure . The vulnerability affects versions before 3.2.45.44 . No speci...
CVE-2026-84789
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to create alert notifications for firewalls outside their assigned scope...
CVE-2026-84791
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below are affected by a Broken Access Control vulnerability. This flaw allows an authenticated low-privilege user to modify Change Management report schedule configurations for firewalls that are outside of their assigned...
CVE-2026-80444
URL redirection to untrusted site 'open redirect' vulnerability in Abis Technology Ltd. Co. AVESİS allows Input Data Manipulation. This issue affects AVESİS: from 202608201331 before 202608240351...