CVEs published May 26, 2026

A flaw was found in KubeVirt's virt-handler component.

A critical Remote Code Execution (RCE) vulnerability exists in Twenty CRM via a chained SQL Injection and PostgreSQL COPY TO PROGRAM attack.

The MCP server creation endpoint validates the command field against an allowlist of binary names but forwards the args array to the child process without any validation.

A vulnerability has been found in Totolink N300RH 6.1c.1353_B20190305.

IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service and a potential remote code execution due to improper input validation.

IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5, 9.0 IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to remote code execution in…

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.

Eppendorf BioFlo 320 is vulnerable due to VNC server using a hard-coded password.

An improper access check allows privelege escalation through the com_users group editing webservice endpoint.

The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.

An improper access check allows privilege escalation through the com_users batch task.

An improper access check allows privilege escalation through the com_users batch task.

FastNetMon Community Edition through 1.2.9 contains an integer overflow in the BGP AS_PATH attribute encoder.

FastNetMon Community Edition through 1.2.9 contains an off-by-one heap-based buffer overflow in the dynamic_binary_buffer_t class (src/dynamic_binary_buffer.hpp).

FastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability in the Juniper router integration plugin.

FastNetMon Community Edition through 1.2.9 contains a stack-based buffer overflow in the BGP NLRI (Network Layer Reachability Information) decoder.

Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a…

AccessControlInterceptor, the authentication gate for all Struts2 actions, unconditionally calls invocation.invoke() without checking for a valid session.

An improper validation of user-supplied input leads to a local file inclusion vulnerability.

IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0 could allow an unauthenticated remote attacker to update server property files that would allow them to gain unauthorized access to the application.

An improper access check allows unauthorized access to com_config webservice endpoints.

Improperly validated order clauses lead to a SQL injection vulnerability in com_tags.

Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_finder.

He WebSocket upgrader for the /exec and /attach endpoints uses CheckOrigin: func(r *http.Request) bool { return true }, accepting upgrade requests from any origin.

An Improper Token validation flaw permits a remote and unauthenticated threat actor to request a JWT for any user including admins given knowledge of their username.

The component override system transpiles user-supplied TSX via Sucrase and evaluates it with new Function, shadowing dangerous globals (fetch, window, eval, etc.) with undefined.

GitLab MCP Server lets an AI agent talk directly to GitLab.

A vulnerability in the Google Cloud Apigee SetIntegrationRequest policy allowed remote attackers to perform Server-Side Request Forgery (SSRF) and exfiltrate service account access tokens.

When the primary toSmbPath(fullPath) call throws, the method falls back to a dirname/basename split and only validates the directory prefix.

The Spindle extension build pipeline calls bun install without the --ignore-scripts flag before running the static backend safety scan (assertSafeBackendBundle).

Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink() without…

When Algernon is asked for any URL path that resolves to a directory without an index file, DirPage walks upward through parent directories — past the configured server root — looking for a file named…

A flaw was found in the Samba printing subsystem.

An attacker is able to downgrade the security of a Bluetooth LE connection by deleting an existing bond, spoofing the bonded device and creating a new bond.

luci-app-https-dns-proxy through 2025.12.29-5 — an optional LuCI web UI add-on for the https-dns-proxy package, distributed through the OpenWrt community packages feed and not installed by default —…

AAn authenticated user with only users.edit permission can escalate their own privileges to admin by sending a PATCH request to /api/v1/users/{id} with permissions[admin]=1.

FreeRDP before 3.26.0 contains a heap-buffer-overflow vulnerability in gdi_CacheToSurface that allows remote attackers to write out-of-bounds heap memory.

NVIDIA Display Driver for Linux contains a vulnerability where an attacker could cause a use-after-free.

The file serving endpoints in Twenty CRM at /files/* and /file/:fileFolder/:id serve uploaded files using fileStream.pipe(res) without setting any Content-Type, Content-Disposition, or…

Faction is vulnerable to stored cross-site scripting (XSS) via attachment filenames in assessment file preview flows.

Faction is vulnerable to stored cross-site scripting (XSS) via attachment filenames in remediation verification file preview flows.

UploadedFileSaveIn() in lua/upload/upload.go uses filepath.Join() with the caller-supplied directory but performs no boundary check after joining.

In a default dozzle deploy (the documented quickstart, no DOZZLE_AUTH_PROVIDER set), POST /api/notifications/test-webhook is reachable without authentication and forwards an attacker-controlled URL into a…

A SQL injection vulnerability exists in the conversation and contact filter APIs.

A prototype pollution vulnerability was discovered in velocityjs.

code100x contains an authentication bypass vulnerability in the Mobile API that allows unauthenticated attackers to impersonate arbitrary users by supplying a crafted JSON payload in the 'g' HTTP header.

A flaw was found in libgnutls.

When algernon is started with --domain (or --letsencrypt, which silently turns on --domain at engine/flags.go:372), the request handler resolves the served directory by joining the configured --dir with the…

LangChain contains older runtime code paths that deserialize run inputs, run outputs, or other application-controlled payloads using overly broad object allowlists.

Using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code.

In engine/luahandler.go, the sync.RWMutex protecting LoadCommonFunctions is released before L.Push() and L.PCall() execute.

A flaw was found in gnutls.

IBM HTTP Server 8.5, and 9.0 is vulnerable to remote code execution and denial of service in configurations with TLS mutual authentication (client authentication).

The affected products insufficiently verify authorization when deleting user accounts.

FastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability in the MikroTik router integration plugin.

FastNetMon Community Edition through 1.2.9 contains a configuration injection vulnerability in the Juniper router integration plugin.

FastNetMon Community Edition through 1.2.9 exposes a gRPC API server on port 50052 with no authentication mechanism.

The Security Gateway does not correctly validate a length value in certain IKE packets when NAT-T is used (4500/UDP).

The VPN service may mishandle an unexpected IKE fragment value received on the IKE port 500/UDP during the early stage of a connection attempt.

An attacker on the network path between the ePA service and the Konnektor can present any TLS certificate (self-signed, expired, wrong CN) and intercept all SOAP traffic.

In SignedPublicKeysTrustValidatorImpl.isTrusted(), the ECDSA signature verification at line 45 discards the boolean return value of Signature.verify().

A Host Header Injection vulnerability in the password reset page allows attackers to manipulate the Host header to generate password reset links pointing to attacker-controlled domains.

IBM HTTP Server 8.5, and 9.0 contains a buffer overflow vulnerability.

Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary commands with elevated privileges via local IPC channel

A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability.

A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability.

A maliciously crafted TIF file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability.

A flaw was found in libsolv.

The affected product extracts installation files to a temporary directory with incorrect default permissions during administrative installation.

The affected product creates a directory with insecure default permissions during administrative installation.

gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard…

A heap-based buffer overflow vulnerability exists in the ID3v2 parsing functionality of MediaInfoLib (version(s): 26.01).

A high-severity vulnerability in the deployment of Genetec RabbitMQ that allows a privilege escalation attack.

A heap-based buffer overflow vulnerability exists in the LXF parsing functionality of MediaInfoLib (version(s): 26.01).

NVIDIA Display Driver for Linux contains a vulnerability in a kernel mode layer handler, where a user could cause improper permission handling.

NVIDIA Display Driver for Windows and Linux contains a vulnerability where an attacker could cause an out-of-bounds write.

NVIDIA Display Driver for Linux contains a vulnerability where an attacker could cause an incorrect conversion between numeric types, leading to a heap buffer overflow.

NVIDIA Display Driver for Windows contains a vulnerability where an attacker could cause a time-of-check time-of-use issue.

NVIDIA Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause improper access to GPU resources.

NVIDIA Transformers4Rec for Linux contains a vulnerability where an attacker could cause improper deserialization of untrusted data.

IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service in configurations where an attacker has write access to parts of the server configuration.

A Server-Side Request Forgery (SSRF) protection bypass vulnerability was identified in versions prior to 0.32.0 affecting redirect-following processing components.

MikroORM's identifier-quoting helper (Platform.quoteIdentifier and the postgres/mssql overrides) and its JSON-path emitters (Platform.getSearchJsonPropertyKey, quoteJsonKey) did not properly escape…

Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header. _read_tar() reads each entry's payload with $handle->read($$data, $block), where…

Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha function.

IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_mem_cache.

IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_ibm_upload.

IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5, 9.0 IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to HTTP request smuggling in…

The affected products perform improper length checking when parsing incoming HTTP requests, resulting in a size-limited out-of-bounds write.

The InputFilter::getInstance() method omitted a security sensitive parameter from the instance cache key.

Insufficient state checks lead to a vector that allows to bypass 2FA checks.

Insufficient state checks lead to a vector that allows to bypass 2FA checks.

FastNetMon Community Edition through 1.2.9 contains multiple out-of-bounds reads in the BGP MP_REACH_NLRI IPv6 attribute decoder.

When the Identity Awareness blade is enabled with Browser-Based Authentication, an unauthenticated user may be able to read certain internal files on the Security Gateway.

When Algernon is invoked with a single file path instead of a directory, singleFileMode is set to true and debugMode is forcibly enabled. debugMode activates the PrettyError renderer, which on any Lua or…

A denial-of-service vulnerability was identified in the cryptographic verification pipeline of Vanetza.

MaxKB's webhook trigger endpoint (/api/trigger/v1/webhook/{trigger_id}) is accessible without authentication.

Banks generates meaningful LLM prompts using a template language that makes sense.

A denial-of-service vulnerability was identified in the ASN.1/OER parsing pipeline of Vanetza.

Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory. _make_special_file() passes the tar header's linkname to link() without…

An improper validation of the search parameter of the com_media files API endpoint leads to a path traversal vulnerability.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magentech SW Core allows PHP Local File Inclusion.

NVIDIA Isaac Launchable for Linux contains a vulnerability where sensitive information is transmitted in clear text.

FastNetMon Community Edition through 1.2.9 does not verify TLS certificates on outbound HTTPS connections.

An attacker who can MITM the TLS connection between the client and the IDP (within the TI network) can substitute a forged discovery document.

A security vulnerability has been detected in code-projects Project Management System 1.0.

A vulnerability was determined in JeecgBoot up to 3.9.1.

A vulnerability has been found in itsourcecode Student Transcript Processing System 1.0.

A flaw has been found in itsourcecode Student Transcript Processing System 1.0.

A vulnerability was detected in itsourcecode Student Transcript Processing System 1.0.

A vulnerability has been found in sambitraj STUDENT-MANAGEMENT-SYSTEM up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5.

A security flaw has been discovered in Das Parking Management System 停车场管理系统 6.2.0.

A vulnerability was identified in Das Parking Management System 停车场管理系统 6.2.0.

A vulnerability was determined in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 1.3.0.

A vulnerability was found in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 10.

A vulnerability was identified in itsourcecode Electronic Judging System 1.0.

A vulnerability was found in itsourcecode Electronic Judging System 1.0.

A vulnerability has been found in itsourcecode Electronic Judging System 1.0.

A vulnerability was detected in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 3000WEBV2.

A security vulnerability has been detected in fraillt bitsery up to 5.2.4.

A vulnerability was determined in hemant6488 CodeIgniter-StudentManagementSystem.

Versions of the package @koa/router from 14.0.0 and before 15.0.0 are vulnerable to Access Control Bypass due to the middleware being silently dropped from the execution chain when the router prefix…

IBM HTTP Server 8.5, and 9.0 is vulnerable to invalid pointer dereference.

An integer overflow in the internal capacity calculation of smallbitvec can lead to an undersized heap allocation, resulting in a heap buffer overflow through safe APIs only.

An organization admin can escalate their privileges by adding a user from a different organization with higher privileges, to their own organization.

OpenKM 6.3.12 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary Java/BeanShell code through the /admin/Scripting endpoint.

OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to execute arbitrary SQL statements against the application database via the DatabaseQuery…

IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0 could allow an attacker with administrative privileges to execute remote code due to exposed method that is not properly restricted.

FastNetMon Community Edition through 1.2.9 contains an integer overflow vulnerability in the packet capture buffer allocation.

A flaw was found in gnutls.

IBM Engineering Lifecycle Management 7.0.3 Interim Fix 001 through  Interim Fix 021, 7.1.0  Interim Fix 001 through  Interim Fix 009, and 7.2.0 and 7.2.0 Interim Fix 001 is vulnerable to an XML external…

NVIDIA Display Driver for Linux contains a vulnerability where a user could cause an out-of-bounds read.

NVIDIA Display Driver for Linux contains a vulnerability in UVM, where a user could cause improper input validation.

NVIDIA vGPU software contains a vulnerability in the virtual GPU manager, where an attacker could cause a use-after-free for stack memory.

IEC 60870-5-104 used in bidirectional mode in RTU500 is vulnerable for a NULL pointer dereferencing, if a specially crafted sequence of messages is sent for a certain time, causing Denial of Service impact.

User passwords are stored using unsalted MD5 hashes, making them trivially crackable via rainbow tables or GPU-accelerated brute force (hashcat).

The ReaderController.GetImage endpoint is decorated with [AllowAnonymous], allowing completely unauthenticated access to page images from any chapter in any library.

A Pre-Account Takeover (Pre-ATO) vulnerability existed in Chatwoot's authentication flow.

A security vulnerability has been detected in SourceCodester eDoc Doctor Appointment System 1.0.

The HTTP `Host` request header was not validated before being used to reconstruct `request.url`.

FastNetMon Community Edition through 1.2.9 has out-of-bounds memory access because it incorrectly parses BGP path attributes with the extended length flag set.

FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read in the NetFlow v9 options template parser.

FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read vulnerability in the NetFlow v9 data flowset processor.

A missing authorization vulnerability in Zyxel GS1200-5v3 firmware versions through 1.00(ACPS.2)C0, GS1200-8v3 firmware versions through 1.00(ACPT.2)C0,  GS1200-5HPv3 firmware versions through…

Any network-reachable caller can write arbitrary documents to any patient's electronic health record accessible by the institution's SMC-B card.

E107 CMS does not properly enforce CSRF token validation on comment moderation actions.

The preview route derives an example name from the URL and calls it with public_send.

The OpenTelemetry.Exporter.Instana exports telemetry to Instana backend.

A Broken Access Control vulnerability exists in the application, allowing an unauthorized authenticated user to edit comments posted by others.

libyang before 5.2.6 contains a heap use-after-free write vulnerability in lyd_parser_set_data_flags that incorrectly updates metadata list pointers when freeing non-head default metadata entries.

Files or Directories Accessible to External Parties, Server-Side Request Forgery (SSRF) vulnerability in Apache Flink Kubernetes Operator.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mashup allows Stored XSS.

NVIDIA Display Driver for Linux contains a vulnerability in the Multi-Instance GPU (MIG) partition management, where an insecure default initialization of memory subsystem routing resources could lead to…

NVIDIA Display Driver for Windows and Linux contains a vulnerability where an attacker could leak held driver locks.

A vulnerability was identified in JeecgBoot up to 3.9.1.

A vulnerability was found in JeecgBoot up to 3.9.1.

A vulnerability was determined in haojing8312 WorkClaw up to 0.6.4.

A weakness has been identified in CodeAstro Leave Management System 1.0.

A flaw has been found in Totolink CA750-PoE 6.2c.510.

A vulnerability was detected in Totolink CA750-PoE 6.2c.510.

A security vulnerability has been detected in Totolink CA750-PoE 6.2c.510.

A weakness has been identified in Totolink CA750-PoE 6.2c.510.

A flaw has been found in xianrendzw EasyReport up to 2.0.17.0522_Beta.

A vulnerability was detected in Totolink CA750-PoE 6.2c.510.

SSRF via work_flow_template Import.

eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information.

MaxKB v2.8.0 and prior are vulnerable to a server-side request forgery (SSRF) bypass in the OSS file service URL fetch (chat/api/oss/get_url) endpoint.

Missing Authorization vulnerability in Magepeople inc.

IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_fastcgi module.

FastNetMon Community Edition through 1.2.9 has a buffer overflow, a different vulnerability than CVE-2026-48686 and CVE-2026-48689.

Lack of input filtering leads to an XSS vector in the HTML filter code.

Inadequate content filtering within the checkAttribute methods leads to XSS vulnerabilities in various components.

In the Prometheus server's legacy web UI (enabled via the command-line flag --enable-feature=old-ui), the histogram heatmap chart view does not escape le label values when inserting them into the HTML for…

Render_toc_ul() builds a <ul> table-of-contents tree from a list of (level, id, text) tuples.

HTMLRenderer.heading() builds the opening <hN> tag by string-concatenating the id attribute value directly into the HTML — with no call to escape(), safe_entity(), or any other sanitisation function.

In src/mistune/directives/image.py, the render_figure() function concatenates figclass and figwidth options directly into HTML attributes without escaping.

The mistune math plugin renders inline math ($...$) and block math ($$...$$) by concatenating the raw user-supplied content directly into the HTML output without any HTML escaping.

Lack of output escaping leads to a XSS vector in the readmore links for com_content.

Lack of output escaping leads to a XSS vector in the content history component.

Lack of output escaping leads to a XSS vector in the multilingual associations component.

Lack of output escaping leads to a XSS vector in the feed modules.

Uncontrolled Resource Consumption vulnerability in oban-bg oban_web ('Elixir.Oban.Web.CronExpr' modules) allows memory exhaustion via unbounded cron range expansion.

The system test entrypoint canonicalizes a user-controlled file path with File.realpath, then checks whether the resolved path starts with the temp directory path.

An open redirect vulnerability in Snipe-IT allows attackers to redirect users to malicious sites via unvalidated HTTP Referer header stored in session variable.

A path traversal vulnerability in IArchive.WriteToDirectory() allows a malicious archive to create directories outside the intended extraction root.

The download, size-check, and chapter metadata endpoints do not enforce library-level authorization.

eventsource-encoder encodes events as well-formed EventSource/Server Sent Event (SSE) messages.

NVIDIA vGPU software contains a vulnerability in the virtual GPU manager, where an attacker could cause an out-of-bound access.

Zohocorp Zoho Mail wordpress plugin is vulnerable to Cross-Site request forgery (CSRF).

When the DLP is active, the UserCheck Web Portal contains an input-handling issue in the UserChoice flow.

NVIDIA GPU Display Driver for Linux contains a vulnerability where an advanced attacker could use a race condition to leak sensitive memory, which might cause limited exposure of sensitive information to…

A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can cause a Stack Exhaustion vulnerability, leading to a denial-of-service condition.

A maliciously crafted PAR file, when parsed through Autodesk 3ds Max, can force a NULL Pointer Dereference vulnerability.

FastNetMon Community Edition through 1.2.9 is vulnerable to a local symlink attack via predictable file paths in /tmp.

The following vulnerability has been resolved: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() Add the same NULL guard already present in l2cap_sock_resume_cb() and l2cap_sock_ready_cb().

The following vulnerability has been resolved: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() Add the same NULL guard already present in l2cap_sock_resume_cb() and…

The following vulnerability has been resolved: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() Add the same NULL guard already present in l2cap_sock_resume_cb() and l2cap_sock_ready_cb().

A security flaw has been discovered in Squirrel up to 3.2.

A vulnerability was identified in vllm-project vllm 0.19.0.

Missing Authorization vulnerability in oban-bg oban_web ('Elixir.Oban.Web.Jobs.DetailComponent' modules) allows unauthorized job worker substitution.

A Check Point HTTP-based service can incorrectly handle malformed HTTP requests.

Mojolicious::Plugin::Statsd versions through 0.04 for Perl allowed metric injections.

MaxKB 2.8.0 and prior are vulnerable to a broken access control vulnerability in the OSS file service URL fetch API (chat/api/oss/get_url).

A flaw was found in gnutls.

Missing Authorization vulnerability in TeconceTheme Mayosis Core allows Exploiting Incorrectly Configured Access Control Security Levels.

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in SpabRice Nyla allows Code Injection.

Missing Authorization vulnerability in Magepeople inc.

Missing Authorization vulnerability in VideoWhisper.Com Paid Videochat Turnkey Site allows Exploiting Incorrectly Configured Access Control Security Levels.

MaxKB 2.8.0 and prior are vulnerable to a server-side request forgery (SSRF) bypass in the OSS file service URL fetch functionality due to inconsistent DNS resolution between validation and actual request…

A weakness has been identified in ThingsBoard up to 4.3.1.1.

The workflow .github/workflows/python_checks.yml embeds ${{ github.event.pull_request.title }} directly inside double-quoted bash strings in four separate steps across four jobs, each passing it as a CLI…

OpenKM 6.3.12 contains a local file inclusion vulnerability in the administrative scripting interface at /admin/Scripting that allows authenticated administrators to read arbitrary files by supplying an…

Crypt::ScryptKDF versions through 0.010 for Perl uses insecure random number source when no CSPRNG module is available.

Users with component view access could be impacted by an unescaped notes column, resulting in cross-site scripting (XSS).

ConsumeNonce() only checks that the module-level variable is set and unexpired.

The Image directive plugin validates the :width: and :height: options with a regex compiled as _num_re = re.compile(r"^\d+(?:\.\d*)?").

NVIDIA Display Driver for Linux contains a vulnerability in a kernel module, where a user could cause a race condition by reordering compiler or processor memory instructions.

Missing password field masking vulnerability in Hitachi Ops Center Analyzer (Hitachi Ops Center Analyzer detail view, Hitachi Ops Center Analyzer probe modules), Hitachi Ops Center Analyzer viewpoint,…

A heap-based buffer overflow vulnerability exists in XML parser functionality in the HiDraw.

The v1 access token introspection endpoint (/auth/v1/introspect_access_token) accepts any JWT signed by a key present on the node, without validating the JWT type, issuer-to-key binding, or required claims.

A vulnerability was detected in JeecgBoot up to 3.9.1.

A weakness has been identified in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0.

A security flaw has been discovered in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0.

A vulnerability was identified in teableio teable up to 1.9.x.

A vulnerability was determined in itsourcecode Electronic Judging System 1.0.

A weakness has been identified in blitz-js blitz up to 3.0.2 on GitHub.

A security flaw has been discovered in stonith404 pingvin-share up to 1.13.0.

A vulnerability was identified in hemant6488 CodeIgniter-StudentManagementSystem.

An improper access check allowed low privileged users to edit the task types of existing scheduler tasks.

Bugsink resolved sourcemaps and debug files by debug ID without scoping that lookup to the project that owned the uploaded metadata.

The SSE event server's Access-Control-Allow-Origin response header was hardcoded to the wildcard * regardless of the caller's Origin.

The SSE event server bound to 0.0.0.0:5553 on Linux/macOS by default because the platform-dependent host default in engine/flags.go:39-46 set host = "" for non-Windows, and utils.JoinHostPort("", ":5553")…

The SAP Gateway allows attackers to inject content into error messages, potentially leading to disclosure of request artefacts (e.g., regex patterns) and revealing underlying URI parsing logic.

Bugsink’s webhook URL validation could be (partially) bypassed because of a mismatch in URL parsing.

DeviceResource.uploadImage authorizes the target device only through Condition.Permission(User.class, getUserId(), Device.class) and then immediately streams the uploaded body into…

You can access the local environment by specifying the URL of the local environment from "Image/File URL:" of "From a remote location" in "Media Manager" on the administrator screen.

An Insecure Direct Object Reference (IDOR) vulnerability was discovered in ONLYOFFICE DocSpace before 3.2.1.

PbootCMS v.3.2.11 contains a code injection vulnerability in its site configuration functionality

Lack of CSRF token validation lead to a CSRF attack vector in the admin activation endpoint of com_users.

Missing Authorization vulnerability in Magepeople inc.

Missing Authorization vulnerability in Webful Creations RepairBuddy allows Exploiting Incorrectly Configured Access Control Security Levels.

Missing Authorization vulnerability in bPlugins Tiktok Feed allows Exploiting Incorrectly Configured Access Control Security Levels.

When Compliance is enabled on Check Point Multi-Domain Management, an authenticated administrator with read-write access to one Management Domain (CMA) can modify stored metadata associated with Compliance…

This vulnerability stems from a business logic flaw.Attackers can exploit legitimate application functions in unintended and abnormal ways, deviating from the designer's expectations, to carry out malicious…

Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another.

A security vulnerability has been detected in GPAC up to 2.4.0.

A security flaw has been discovered in GPAC up to 2.4.0.

A weakness has been identified in GNU LibreDWG up to 0.14.

A security flaw has been discovered in GNU LibreDWG up to 0.14.

In affected versions, the issue list view authorizes access through the project in the URL, but applies the requested bulk action to the submitted issue IDs without also requiring those issues to belong to…

Bugsink issue event pages accept a direct event identifier from the URL and, in affected versions, look up that event without also requiring it to belong to the issue in the URL.

A vulnerability was found in SourceCodester/oretnom23 Hospitals Patient Records Management System 1.0.