CVEs published September 14, 2026
77,396 CVEs in 2026
A validation issue existed in the entitlement verification.
froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing authenticated customers to inject arbitrary nginx or Apache configuration directives.
A weakness has been identified in D-Link DWR-M920 1.1.7.
A flaw has been found in D-Link DIR-878 120B05.
A vulnerability was detected in D-Link DIR-878 120B05.
A security flaw has been discovered in D-Link DIR-823G 1.0.2B05_20181207.
A flaw has been found in Totolink A3002MU Hh-B20211125.1046.
A vulnerability was detected in Totolink A3002MU Hh-B20211125.1046.
A security vulnerability has been detected in Totolink A3002MU Hh-B20211125.1046.
A weakness has been identified in Totolink A3002MU Hh-B20211125.1046.
IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to perform an arbitrary file write due to improper validation of file paths.
Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables.
LightLLM through 1.2.0 contains a remote code execution vulnerability in the Config Server's unauthenticated /visual_register WebSocket endpoint that passes the first client frame directly to pickle.loads().
Bifrost registers MCP clients through its management API.
Cypher injection vulnerability in the Neo4j persistence layer when processing some FIQL search conditions.
A permissions issue was addressed with improved path validation.
A double free issue was addressed with improved memory management.
A buffer overflow was addressed with improved size validation.
Missing authentication for critical function vulnerability exists in CPSL-08P1EN.
Description The DRPC server kept a map from function name to request queue and created an entry the first time a function name was seen.
Description The worker's Netty message decoder is installed ahead of the SASL authentication handlers in the pipeline and acts on frames before any authentication has taken place.
Description `SimpleACLAuthorizer` evaluated the user-level command set by returning early when `nimbus.users` was empty, before `nimbus.groups` was considered.
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope.
Incorrect privilege assignment vulnerability in Apache Syncope.
Incorrect Authorization vulnerability in Apache Syncope.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope.
A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the…
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal…
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal…
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal…
Missing Authorization vulnerability in Apache Syncope.
Incorrect Authorization vulnerability in Apache Syncope.
Incorrect Authorization vulnerability in Apache Syncope.
Improper Privilege Management vulnerability in Apache Syncope.
Incorrect Authorization vulnerability in Apache Syncope.
An out-of-bounds write issue was addressed with improved bounds checking.
The dashboard reads its authentication credentials from `$ESPHOME_USERNAME` and `$ESPHOME_PASSWORD`.
Praisonai.jobs.server.create_app mounts praisonai.jobs.router.create_router under /api/v1/runs without authentication or per-job authorization.
Recipe serve installs APIKeyAuthMiddleware or JWTAuthMiddleware when an operator selects api-key or JWT authentication, but each middleware forwards requests when PRAISONAI_API_KEY or PRAISONAI_JWT_SECRET…
The unauthenticated POST /api/v1/runs Jobs API accepts attacker-controlled agent_yaml, and the approve field can mark execute_command as YAML-approved before @require_approval checks critical tools.
The default UI host applications expose POST /api/mcp/connect without mandatory authentication and accept caller-controlled command and args values that PraisonAIUI passes to StdioMCPClient to start a local…
ToolsMCPServer.run_sse and launch_tools_mcp_server bind to 0.0.0.0 and create /sse and /messages/ routes without invoking the available SecurityConfig authentication, origin-validation, or DNS-rebinding…
resdata is software for reading and writing result files from the Eclipse reservoir simulator.
UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files.
UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files.
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal…
Casdoor through 4.4.0 fails to properly mask the instance-wide built-in certificate private key in /api/get-certs and /api/get-cert endpoints, allowing organization administrators to retrieve it.
IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges (UID=0) on the Langflow server by submitting components containing socket or urllib imports.
An improper validation vulnerability exists within PingAM where a well-crafted request allows arbitrary or protected ID Token claims to be set or overridden.
Joomla Extension - regularlabs.com - Authenticated, privileged remote code execution in Conditional Content extension for Joomla < 8.0.0 - Conditional Content Pro accepts inline PHP Condition Rules in…
The LdapAuth and LinOTPAuth authentication plugins in MISP contain an authentication bypass vulnerability.
Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code.
4.3.15, and 5.0.0-preview09-final, AuthorizeActionFilter performs no authorization because its explicit ICommandActionFilter.OnCommandExecutingAsync, IViewModelActionFilter.OnViewModelCreatedAsync, and…
Inadequate access control in Hiperdino’s REST v1.0 API.
A vulnerability has been found in D-Link DWR-M921 1.1.52.
A flaw has been found in D-Link DWR-M921 1.1.52.
Improper verification of cryptographic signature vulnerability in Apache Syncope.
Authentication bypass by spoofing vulnerability in Apache Syncope.
A certificate validation issue was addressed with improved certificate validation.
A permissions issue was addressed with additional sandbox restrictions.
Description A submitted topology carries two lists of blobstore keys, `dependency_jars` and `dependency_artifacts`, which the client fills in after uploading the corresponding blobs.
In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive extraction can extract files to locations outside of the pack, allowing writing of…
Store and LegacyStore use attacker-controlled JSON:API type, id, and relationship names as keys in plain-object lookup tables in src/yayson/store.ts and src/yayson/legacy-store.ts.
Src/praisonai/praisonai/tools/multiedit.py passes the LLM-controlled filepath parameter directly to open for reading and writing without traversal rejection, symlink resolution, a workspace boundary, or…
To_absolute_normalized_path in internal/gatewayapi/luavalidator/security.lua does not collapse redundant separators before is_critical_path evaluates Lua submitted through EnvoyExtensionPolicy during…
Anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to SQLite without restricting ATTACH DATABASE filesystem targets.
The issue was addressed with improved memory handling.
Concrete CMS below 9.5.3 did not sanitize custom style values in the Block Design dialog before writing them into page CSS via a DOM sink, permitting stored cross-site scripting.
DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream.
A security flaw has been discovered in Tenda W20E 15.11.0.61068_1546_841_CN_TDC.
A logic issue was addressed with improved checks.
A buffer overflow was addressed with improved bounds checking.
SolarView Compact contains an OS command Injection vulnerability in in Schedule Settings.
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit.
An improper neutralization of directives in dynamically evaluated code ('Eval Injection') issue exists in CONPROSYS HMI System(CHS).
Unrestricted upload of file with dangerous type issue exists in CONPROSYS TM Series.
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS TM Series.
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS PAC Series.
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series.
Buffer overflow vulnerability exists in Contec EC1000 series.
Buffer overflow vulnerability exists in Contec RP-WAH-SR Series.
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in SGA1000.
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Contec FX5000 series, FX4000 series, and FX3000 series.
Description Dependency artifacts uploaded with `storm jar --artifacts` were stored under a blob key derived only from the Maven coordinate, for example `dep---.jar`.
Magistrala before 1.0.0 contains a SQL injection vulnerability in the timescale-reader and postgres-reader HTTP API services that allows authenticated attackers to inject arbitrary SQL by supplying a…
Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access or modify data they are not authorized to.
An out-of-bounds write issue was addressed with improved bounds checking.
An integer overflow was addressed with improved input validation.
A memory corruption issue was addressed with improved validation.
Laravel MagicLink creates links for authentication without a password or for accessing private content.
12.3.10, and 2026.1.6, an authenticated user with reports_config permission can place attacker-controlled SQL fragments in the sql, from, where, and groupby fields of a Custom Reports configuration…
A buffer overflow was addressed with improved bounds checking.
A validation issue was addressed with improved input sanitization.
A use-after-free issue was addressed with improved memory management.
IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special characters in the PxPeek name…
IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary commands due to os command injection.
IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary code due to improper configuration of the XSLT transformation engine.
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could…
parallax filament-comments through 3.0.0 contains a stored cross-site scripting vulnerability in comment body rendering that allows authenticated panel users to inject malicious scripts.
Servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in…
The REST API page update endpoint (PUT /ccm/api/1.0/pages/{cID}) did not enforce page-property, page-template, or page-type authorization.
Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables.
Conform, a type-safe form validation library, allows the parsing of nested objects in the form of object.property.
LangBot's plugin runtime (pip package langbot_plugin) through 0.4.17 starts a debug WebSocket server on 0.0.0.0:5401 (/plugin/ws) whose authentication is gated on plugin_debug_key, which defaults to an…
ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vulnerability in its REST API endpoints that allows unauthenticated attackers to access and manipulate…
Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL Injection in the "hookActionObjectProductUpdateBefore", "hookActionObjectCategoryUpdateBefore", and…
Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder (Free and Pro) 5.2.1 - 6.9.0 - plgContentSppagebuilder::onContentAfterSave() read…
The WhatsApp and Linear bot webhook handlers verify HMAC signatures only when WHATSAPP_APP_SECRET or LINEAR_WEBHOOK_SECRET is configured and otherwise parse and dispatch unsigned request bodies.
Anyquery server exposes URL-capable SQLite virtual table modules such as json_reader and log_reader through its unauthenticated MySQL-compatible server port without restricting outbound destinations.
Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL Injection in the toggleCategoryPromotionAction method.
Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation.
Ekia File Manager 1.2.7 exposes com.ekia.filecontrolmanager.OpenFileProvider as an exported Android ContentProvider without requiring caller permissions.
SpiderTools._validate_url calls _host_is_blocked, which checks literal host encodings but does not resolve DNS names before scrape_page, crawl, extract_links, extract_text, or URL-mention fetches connect.
An authenticated user with the objects permission can submit a malicious ClassDefinition UID because the name and ID validation expressions in models/DataObject/ClassDefinition.php validate only the…
A role-based access control issue was identified in the administrative expression evaluation functionality.
A local privilege escalation vulnerability in the Logitech Logi Options+ updater service on Windows allows a low-privileged local user to execute arbitrary code as SYSTEM.
Affected versions of MISP’s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsistencies.
The agent creates workload files and Control Interface named pipes (FIFOs) under a predictable path derived from the agent name and a hash of the workload's runtime configuration.
This issue was addressed with improved handling of symlinks.
A buffer overflow was addressed with improved bounds checking.
The issue was addressed with improved checks.
An out-of-bounds write issue was addressed with improved bounds checking.
The tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link.
The installer for Rakuten Kobo Desktop Application (Windows version) insecurely loads Dynamic Link Libraries.
Garminconnect/client.py Client.dump creates the OAuth token directory and garmin_tokens.json without explicit owner-only modes, so a permissive umask such as 022 can leave the directory mode at 0755 and the…
A security flaw has been discovered in Open5GS up to 2.7.x.
A security vulnerability has been detected in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04.
gettext-converter provides gettext resource conversion utilities for JavaScript.
Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without authentication, allowing unauthenticated attackers to inject arbitrary emails into the CRM inbox.
Missing Authentication for Critical Function (CWE-306) in the checkout session lookup handler (src/app/api/stripe/checkout_sessions/route.ts), exposed at GET /api/stripe/checkout_sessions, in MarcosCamara01…
Double free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.
An access issue was addressed with additional sandbox restrictions.
An authorization issue was addressed with improved state management.
The opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go can allow an oversized declared Content-Length request to bypass a deny-on-presence Rego policy because…
A permissions issue was addressed with additional restrictions.
4.3.15, and 5.0.0-preview09-final, a route containing multiple unconstrained parameters in one path segment can cause excessive regular-expression backtracking in DotvvmRoute.IsMatch when a remote requester…
Setting PRAISONAI_CALL_AUTH to disabled makes verify_token accept requests to /api/v1/agents/{id}/invoke without CALL_SERVER_TOKEN authentication.
The /skin/ action in com.xpn.xwiki.web.SkinAction can resolve double-encoded parent-directory segments outside the intended skin or web-application resource prefix when Jetty 12 or later decodes the request…
IBM Cloud Pak for Data System (Yosemite 1.0) 3.0.5.2 could allow a remote attacker to obtain sensitive information due to the use of weak or deprecated cryptographic protocols.
File Browser versions >= 2.5.0 and <= 2.63.23 contain an incorrect authorization flaw in the direct-upload endpoint (resourcePostHandler in http/resource.go).
An out-of-bounds read was addressed with improved bounds checking.
Path traversal vulnerability exists in SGA1000.
Path traversal vulnerability exists in Contec FX5000 series, FX4000 series, and FX3000 series.
Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP components served to an authenticated user.
Description Nimbus validated `topology.blobstore.map` against the calling subject at submission time only.
Concrete CMS 9 through 9.5.2 did not validate a CSRF token in the orphaned block removal panel action (removeOrphanedBlocks).
A race condition was addressed with additional validation.
An improper input validation vulnerability in Zscaler Client Connector on Android and ChromeOS allows an attacker to potentially bypass Zscaler controls.
Src/praisonai-agents/praisonaiagents/tools/email_tools.py interpolates LLM-controlled from_addr, subject, and query values directly into quoted IMAP SEARCH criteria.
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels.
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels.
A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector (ZCC) allows a heap corruption, resulting in a denial of service (client crash) and potentially arbitrary code…
IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to read, write, or delete arbitrary files due to a path traversal vulnerability.
A flaw was found in GIMP's PSP (Paint Shop Pro) file loader.
A flaw was found in GIMP's ICO file loader.
A flaw was found in GIMP.
Parallels Desktop runs prl_disp_service as root.
A permissions issue was addressed with additional restrictions.
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally.
This issue was addressed with additional entitlement checks.
A race condition was addressed with improved state management.
An out-of-bounds write issue was addressed with improved bounds checking.
A path traversal issue was addressed with improved path validation.
The issue was addressed with improved memory handling.
An out-of-bounds write issue was addressed with improved bounds checking.
An out-of-bounds write issue was addressed with improved bounds checking.
A race condition was addressed with improved state handling.
A use after free issue was addressed with improved memory management.
An out-of-bounds write issue was addressed with improved bounds checking.
A buffer overflow was addressed with improved size validation.
Description When launching a Docker or OCI worker, the setuid-root `worker-launcher` first changes ownership of the entire worker directory to the untrusted topology user, and only afterwards reads and…
Description The setuid-root `worker-launcher` binary adjusts ownership and permissions of worker directories by walking the tree with FTS and calling `lchown` and `chmod` on each entry's full pathname…
Description A topology's `topology.blobstore.map` lets the submitter choose a local name for each blob that the supervisor localises.
An out-of-bounds access issue was addressed with improved bounds checking.
This issue was addressed with improved checks.
The issue was addressed with improved memory handling.
An out-of-bounds write issue was addressed with improved bounds checking.
A path handling issue was addressed with improved validation.
This issue was addressed with improved checks.
A permissions issue was addressed with additional restrictions.
This issue was addressed with additional entitlement checks.
A race condition was addressed with improved locking.
The issue was addressed with improved memory handling.
A path handling issue was addressed with improved validation.
A permissions issue was addressed with additional restrictions.
A memory corruption issue was addressed with improved input validation.
A use-after-free issue was addressed with improved memory management.
An issue was discovered in MFC in Samsung Mobile Processor and Wearable Processor Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 2600, 1680, W920, W930, and W1000.
A flaw was found in NetworkManager-l2tp.
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization.
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization.
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to improper neutralization of special elements used in an OS…
The confluence_upload_attachment and confluence_upload_attachments tools pass a client-controlled file_path through src/mcp_atlassian/confluence/attachments.py upload_attachment, and the jira_update_issue…
LangChain MongoDB provides integrations between MongoDB, Atlas, LangChain, and LangGraph.
The UserNameIdentityToken authentication handler in packages/node-opcua-server/source/opcua_server.ts decrypts an RSA-OAEP password blob but does not verify that the trailing bytes match the current session…
Cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as…
An issue in the /api/v2/setting/adserversetting endpoint of Suprema BioStar 2 before 2.9.12 and and BioStar X before 1.0.2 allows attackers to obtain Active Directory service account credentials in…
Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding.
IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage PxXMLInput operator could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection.
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels.
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels.
FileField and ImageField can accept browser-executable uploads while templates/crud/field/file.html.twig links to stored files for inline same-origin rendering without a download attribute or…
ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoint.
webhook through 2.8.3 reads the entire request body into memory before evaluating trigger rules, allowing unauthenticated attackers to exhaust memory by sending oversized bodies.
DeepWiki-Open through commit d92819a contains an arbitrary file read vulnerability in the unauthenticated /ws/chat WebSocket endpoint that accepts repo_url as a filesystem path with no containment.
EFence developed by Thinking Software Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents.
Joomla Extension - regularlabs.com - Privileged stored XSS via event handler option in Modals Pro extension for Joomla < 17.0.0 - Modals Pro intentionally supports JavaScript Events such as on-open and…
Joomla Extension - regularlabs.com - Privileged stored XSS via url option in Snippets Free extension for Joomla < 7.0.0, Snippets Pro extension for Joomla < 11.0.0 - Snippets substitutes variable values…
Insertion of sensitive information into log file vulnerability in Apache Syncope.
A privacy issue was addressed with improved state management.
An information disclosure issue was addressed with improved state management.
A logic issue was addressed with improved checks.
Joomla Extension - regularlabs.com - Privileged stored XSS via link option in Articles Anywhere extension for Joomla < 20.0.0 - Articles Anywhere accepts link options such as onclick and onmouseover.
Joomla Extension - regularlabs.com - Privileged stored XSS via rtla-alias option in Tabs & Accordions extension for Joomla < 3.1.0 - Tabs & Accordions rewrites links matching an item alias into calls to its…
Joomla Extension - regularlabs.com - Privileged stored XSS via class option in Quick Index extension for Joomla < 5.0.5 - Quick Index inserts configurable class values into generated HTML without escaping…
Joomla Extension - regularlabs.com - Privileged stored XSS via executable URL schemes in Modals extension for Joomla < 17.0.0 - Modals treats a destination using an executable browser URL scheme as an…
This issue was addressed with additional entitlement checks.
An authorization issue was addressed with improved state management.
A privacy issue was addressed with improved handling of identifiers.
A path traversal issue was addressed with improved path validation.
A logic issue was addressed with improved checks.
A resource exhaustion issue was addressed with improved input validation.
An out-of-bounds read was addressed with improved bounds checking.
An integer overflow was addressed with improved input validation.
An out-of-bounds access issue was addressed with improved bounds checking.
Insertion of sensitive information into sent data vulnerability in Apache Syncope.
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal…
Incorrect Authorization vulnerability in Apache Syncope.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Syncope.
The issue was addressed with improved checks.
An authorization issue was addressed with improved state management.
The issue was addressed with improved authentication.
An out-of-bounds read was addressed with improved bounds checking.
A permissions issue was addressed with improved validation.
A privacy issue was addressed with improved handling of user preferences.
Argos JavaScript provides official Argos SDKs for JavaScript.
On affected versions of Zscaler client connector, a pre-installed peer app can tear down the Zscaler tunnel, force user logout, and toggle packet capture.
8.0.15, 8.1.14, and 8.2.6, the unauthenticated GET /api/pages/nested endpoint implemented by Api::PagesController#nested in app/controllers/alchemy/api/pages_controller.rb returns an unfiltered page tree…
MentionsParser._process_file_mention accepts file-mention values and falls back from workspace-relative resolution to Path(file_path) without traversal, symlink, or workspace-boundary validation.
The unauthenticated Jobs API accepts an absolute or traversing agent_file path in POST /api/v1/runs and passes it to the job executor without a workspace allowlist or boundary check.
flat-to-nested converts a hierarchy from a flat representation to a nested representation.
RTPChannel.OnRTPPacketReceived and the STUNAttribute.ParseMessageAttributes, STUNXORAddressAttribute, and STUNAddressAttribute parsing path index untrusted bytes without sufficient length checks, while…
Anyquery server exposes file-backed SQLite virtual table modules such as csv_reader and log_reader through its MySQL-compatible server port without authentication, authorization, or directory restrictions.
Flask-Reuploaded provides file uploads for Flask.
The process-global g_alreadyUsedNonce cache used by nonceAlreadyBeenUsed in packages/node-opcua-secure-channel/source/server/server_secure_channel_layer.ts records nonces from OpenSecureChannelRequest and…
PropertyResolver and adjacent helpers recursively follow the WordprocessingML w:basedOn style inheritance chain without cycle detection.
5.42.0.0, and 6.49.0.0, ServerFilters.GZip, RequestFilters.GunZip, and the underlying Gzip request-body decompression functions impose no limit on decompressed size.
dd-trace-rb is Datadog's client library for Ruby.
W3C baggage extraction does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS, which defaults to 64, or DD_TRACE_BAGGAGE_MAX_BYTES, which defaults to 8192, although those limits apply during baggage injection.
An access issue was addressed with additional sandbox restrictions.
An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680.
A denial-of-service issue was addressed with improved validation.
A privacy issue was addressed by moving sensitive data.
The issue was addressed with improved memory handling.
IBM Sterling File Gateway 6.2.0.0 through 6.2.0.6_1, 6.2.1.0 - 6.2.1.2, 6.2.2.0 - 6.2.2.1 could allow a remote attacker to obtain sensitive information due to improper access control.
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths.
IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources.
Five HTTP/1.1 conformance laxities in the hand-written Java parser under http/src/main/java/org/http4s/blaze/http/parser/ can cause blaze to derive a different request boundary than a stricter fronting…
Pay::Webhooks::PaddleBillingController#valid_signature? in app/controllers/pay/webhooks/paddle_billing_controller.rb compares the computed 64-character SHA-256 HMAC with the attacker-controlled h1 token…
The xDS gRPC server in GatewayNamespaceMode, configured through provider.kubernetes.deploy.type=GatewayNamespace, installs a JWT StreamInterceptor but no UnaryInterceptor, leaving every unary Fetch RPC…
A weakness has been identified in a2aproject a2a-java 1.2.0.
A vulnerability was identified in HKUDS nanobot up to 0.2.1.
A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578.
A weakness has been identified in itsourcecode Leave Management System 1.0.
A vulnerability was identified in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e.
A security vulnerability has been detected in marcobambini Gravity up to 0.9.7.
A vulnerability was determined in taisan tarzan-cms 1.0.0.
A weakness has been identified in Yot CMS up to 3.3.1.
A vulnerability was detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578.
A weakness has been identified in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04.
A vulnerability was determined in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04.
A vulnerability has been found in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04.
A flaw has been found in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2.
A vulnerability was detected in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2.
The issue was addressed with improved memory handling.
An integer overflow was addressed with improved input validation.
An out-of-bounds write issue was addressed with improved bounds checking.
Improper Encoding or Escaping of Output vulnerability in Apache Syncope.
A memory corruption issue was addressed by removing the vulnerable code.
The CODE_TOOLS wrappers keep _workspace_root as None and pass workspace=None to read_file, search_replace, and apply_diff helpers that enforce path containment only for a truthy workspace.
The clear_plugin_cache(plugin) SQL scalar function in namespace/other_functions.go passes the caller-controlled plugin parameter through path.Join to os.RemoveAll without rejecting traversal segments.
goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements.
LaraDashboard versions 0.9.2 through 1.2.2 contain a path traversal vulnerability in the core-upgrade backup handling.
Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center solution before version 1.5.1 might allow an authenticated remote user with application-level access…
Unrestricted upload of file with dangerous type issue exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit.
Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering.
laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allows any authenticated user to read, overwrite, and delete premium module license keys.
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate channel member-management permission during playbook run creation, allowing an authenticated…
An out-of-bounds write issue was addressed with improved bounds checking.
An out-of-bounds read was addressed with improved bounds checking.
An out-of-bounds read was addressed with improved bounds checking.
An integer overflow was addressed with improved input validation.
PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulnerability in the font branch of extract_objects() in src/__main__.py, where the output filename is constructed by joining a…
Gallery - Private Photo Vault 1.0.41 starts an unauthenticated HTTP server that is reachable from the local network.
An out-of-bounds read was addressed with improved bounds checking.
An out-of-bounds access issue was addressed with improved bounds checking.
An out-of-bounds read was addressed with improved bounds checking.
An out-of-bounds read was addressed with improved bounds checking.
An authentication issue was addressed with improved state management.
A flaw was found in PackageKit.
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 is…
IBM MQ is vulnerable to an XML external entity injection (XXE) attack when processing XML data.
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 Managed…
IBM Business Automation Workflow containers and traditional may use programming model artifacts that are vulnerable to XML Entity Injection attacks by default.
IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection (XXE) attack when processing XML data.
Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Rename Allowing Arbitrary File Rename in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 - The media rename task applied neither of…
The location API does not validate destination hosts when adding an HTTP location to an image.
MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the container package OCI/tar image extraction that allows attackers to write files outside the container root by supplying a…
Joomla Extension - regularlabs.com - Database data disclosure in Advanced Module Manager (Free, Pro) < 12.1.0, Conditional Content (Free, Pro) < 8.0.0, Content Templater (Pro) < 14.2.0, ReReplacer (Pro) <…
Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 - The folder request parameter replaced the generated date-based destination…
Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass in Module Context in the Contact, Opt-in and Form Builder Addons in SP Page Builder Pro 3.2.6 - 5.6.1p2 and 6.0.0 - 6.9.0 - In the…
Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass via Request-Controlled CAPTCHA Configuration in SP Page Builder Pro 5.1.4 - 6.9.0 - The optin_form addon read the CAPTCHA type, the…
CartController in src/controllers/CartController.php activates its RateLimiter only when the number POST or GET parameter is supplied.
The trie language-model loaders in src/lm/ngram_model_trie.c do not adequately validate boundary conditions in ARPA, DMP, and binary format headers, and the acoustic-model loaders in src/mdef.c and…
The GET endpoint exported by next-video/request-handler and commonly mounted at /api/video accepts an unauthenticated url query parameter, while src/utils/utils.ts isRemote() treats any value without an…
File Browser through 2.63.23 applies path rules to the requested lexical path but resolves symbolic links without reapplying rules to the target, allowing authenticated users to bypass deny rules.
The local OAuth helper in src/dbt_mcp/oauth/fastapi_app.py exposes GET /dbt_platform_context without authentication or Host validation after a user completes the dbt Platform OAuth flow.
2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec…
Buffer overflow vulnerability in Panasonic Industry USB Driver for MINAS A5/A6 allows attackers to stop Windows.
The ITE IT82xx2 USB device-controller driver (drivers/usb/udc/udc_it82xx2.c) mishandles multi-packet OUT transfers on non-control endpoints.
The ITE it51xxx I2C driver, when operating as an I2C target (slave) in buffer mode (CONFIG_I2C_TARGET + CONFIG_I2C_TARGET_BUFFER_MODE), copies host-supplied write data into the fixed-size…
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could…
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7 Mattermost failed to validate Dynamic Client Registration redirect URIs by URL component (matching glob patterns against the raw URI…
A vulnerability was identified in D-Link DWR-M921 1.1.52.
A vulnerability was determined in D-Link DWR-M921 1.1.52.
A vulnerability was found in D-Link DWR-M921 1.1.52.
The issue was addressed with improved memory handling.
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels.
The /admin/gateways/test call site in mcpgateway/admin.py calls validate_gateway_test_url() in mcpgateway/common/validators.py to resolve and reject private, loopback, link-local, and cloud-metadata…
An integer overflow was addressed with improved input validation.
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate that a property field belongs to the specified run before updating its value which allows an…
Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml() that fails to disable external entity resolution when parsing…
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 Fail to sanitize Team objects returned by the data retention teams endpoint which allows an authenticated user…
novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks proper permission annotations.
File Browser through 2.63.23 contains a memory exhaustion vulnerability in the subtitle conversion endpoint that loads entire subtitle files into memory without size limits.
filebrowser through 2.63.23 fails to limit WebSocket message size in the /api/command handler before checking permissions, allowing authenticated users to buffer arbitrarily large messages.
A vulnerability was identified in Tenda W20E 15.11.0.61068_1546_841_CN_TDC.
An out-of-bounds read issue was addressed with improved input validation.
An input validation issue was addressed with improved input validation.
An out-of-bounds write issue was addressed with improved bounds checking.
A denial-of-service issue was addressed with improved input validation.
A heap buffer overflow was addressed with improved bounds checking.
An out-of-bounds write issue was addressed with improved bounds checking.
A logic issue was addressed with improved state management.
An out-of-bounds read issue was addressed with improved input validation.
An out-of-bounds read was addressed with improved bounds checking.
A memory corruption issue was addressed by removing the vulnerable code.
A denial-of-service issue was addressed with improved input validation.
An integer underflow was addressed with improved input validation.
An out-of-bounds write issue was addressed with improved bounds checking.
A heap buffer overflow was addressed with improved bounds checking.
An out-of-bounds read was addressed with improved bounds checking.
An integer overflow was addressed with improved input validation.
Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in the topology_conf field of TopologyPageInfo.
Missing authentication for critical function vulnerability exists in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*.
Description When ZooKeeper authentication is configured, Storm deliberately retains `storm.zookeeper.topology.auth.payload` in the topology configuration, because workers need it.
Description `getNimbusConf` returned the complete daemon configuration without redaction after only a user-level authorization check.
Description Nimbus accepted the `uploadedJarLocation` argument of `submitTopology` / `submitTopologyWithOpts` as a server-side path and opened it directly, without checking that it referred to a file the…
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Syncope.
Validate_url_for_ssrf resolves the attacker-controlled X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url header host once at middleware time, but the outbound request is built with the raw hostname and…
Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access data they are not authorized to read, resulting in unauthorized disclosure of…
A null pointer dereference was addressed with improved input validation.
An out-of-bounds write issue was addressed with improved bounds checking.
An out-of-bounds read was addressed with improved bounds checking.
A permissions issue was addressed by removing the vulnerable code.
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels.
Execute_code sandbox mode permits runtime assembly of blocklisted dunder names and allows str.format or str.format_map to resolve dotted fields through C-level attribute access that bypasses _safe_getattr.
SpiderTools.scrape_page validates only the initial URL and lets requests.Session.get follow redirects automatically, so a public-looking URL can redirect to a loopback, private, link-local, or metadata…
A server configured with the primary or deprecated master role allows an unauthenticated, modified GET request to the +changelog route because verify_primary does not reject a missing identity and therefore…
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels.
TranslateSecurityPolicyForRoute in internal/gatewayapi/securitypolicy.go dereferences a nil authorization value when a namespace-scoped tenant creates a SecurityPolicy targeting a TCPRoute and omits…
Internal/wasm/imagefetcher.go follows tenant-controlled EnvoyExtensionPolicy spec.wasm[].code.image.url values to Docker or OCI Wasm layers, and extractWasmPluginBinary uses the untrusted tar-header h.Size…
GetFileFromGZ in internal/wasm/httpfetcher.go calls io.ReadAll on a gzip.Reader without limiting decompressed output when a tenant-controlled EnvoyExtensionPolicy.spec.wasm[].code.http.url points to a…
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit size of unpacked SDP messages compressed with zlib, which allows attacker to deny service or crash…
The Authorizer::authenticate() and Authorizer::supports() paths in the Authorizer security authenticator may accept OAuth 2.0 bearer access tokens from the token URL query parameter as well as the…
A validation issue was addressed with improved input sanitization.
An out-of-bounds write issue was addressed with improved bounds checking.
A use-after-free issue was addressed with improved memory management.
The issue was addressed with improved memory handling.
An out-of-bounds write issue was addressed by removing the vulnerable code.
A buffer overflow was addressed with improved bounds checking.
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to cause a denial of service due to…
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to cause a denial of service due to a null…
IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication and obtain sensitive information by sending a crafted unauthenticated request.
net_if_ipv6_calc_reachable_time() in subsys/net/ip/net_if.c derives a randomized ND reachable time from ipv6->base_reachable_time as min_reachable + sys_rand32_get() % (max_reachable - min_reachable), where…
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit the amount of memory allocated when decoding uploaded image files which allows an authenticated…
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header.
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty could allow a remote attacker to conduct phishing attacks, using an open redirect attack.
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header.
IBM Langflow OSS 1.0.0 through 1.11.5 is vulnerable to server-side request forgery (SSRF).
IBM Langflow OSS 1.0.0 through 1.10.2 is vulnerable to server-side request forgery (SSRF).
IBM Cloud Pak for Business Automation could allow an authenticated user to cause a denial of service due to uncontrolled resource consumption.
An HTTPRoute can use an extension-managed custom backendRef to reference a backend resource in another namespace without a matching Gateway API ReferenceGrant in the target namespace.
Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization.
An issue was discovered in camera in Samsung Mobile Processor Exynos 1580 and 2500.
IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication on an admin console servlet.
A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1.
A flaw has been found in cosmicstack-labs mercury-agent up to 1.1.13.
A security flaw has been discovered in cosmicstack-labs mercury-agent up to 1.1.13.
A vulnerability was determined in HKUDS nanobot up to 0.2.1.
A vulnerability was found in nanocoai NanoClaw up to 2.1.17.
A vulnerability has been found in DjangoCRM django-crm up to 1.2.
A vulnerability was identified in itsourcecode Leave Management System 1.0.
A vulnerability was found in GPAC up to f1219cde.
A vulnerability was detected in GPAC up to f1219cde.
A security vulnerability has been detected in a2aproject a2a-python up to 1.1.3.
A weakness has been identified in marcobambini Gravity up to 0.9.7.
A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0.
A vulnerability was determined in GPAC up to f1219cde.
A vulnerability was identified in ipa-lab HackingBuddyGPT up to 0.5.0.
A weakness has been identified in FedML-AI FedML up to 0.9.6.
In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID.
Insufficiently protected credentials issue exists in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*.
A race condition was addressed with improved state handling.
The privateNetworks list in ip.go omits the IPv6 ranges 64:ff9b:1::/48, 5f00::/16, 3fff::/20, and 100:0:0:1::/64.
IBM i Access Family 1.1.2.0 through 1.1.9.15 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input in a…
IBM i Access Family 1.1.2.0 through 1.1.9.15 IBM i Access Client Solutions could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper…
IBM i Access Family 1.1.2.0 through 1.1.9.15 IBM i Access Client Solutions could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper…
A memory initialization issue was addressed with improved memory handling.
An out-of-bounds write issue was addressed with improved bounds checking.
The HTTP server started by allure serve and allure open uses URI.getPath() in Commands.setUpServer() in allure-commandline/src/main/java/io/qameta/allure/Commands.java and passes the percent-decoded request…
WeasyPrint helps web developers to create PDF documents.
IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 performs input validation exclusively on the client side and fails to enforce the same restrictions on the…
Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links.
An out-of-bounds write issue was addressed with improved bounds checking.
An authorization issue was addressed with improved state management.
Cross-site scripting vulnerability exists in CPSL-08P1EN.
Cross-site scripting vulnerability exists in CONPROSYS PAC Series.
Cross-site scripting vulnerability exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series.
Concrete CMS before 9.5.3 applied only trim() to the YouTube block's stored width and height values and printed them into iframe HTML attributes without escaping or integer casting, resulting in stored…
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Syncope.
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Syncope.
The ansi.js helper at allure-generator/src/main/javascript/helpers/ansi.js passes attacker-influenced statusMessage and statusTrace values through AnsiToHtml without HTML escaping and wraps the result in…
0.22.3, and 0.23.2, the tract-onnx crate passes the attacker-controlled external_data location from an ONNX model through onnx/src/tensor.rs get_external_resources and joins the value to the model directory…
0.22.2, and 0.23.1, tract-nnef uses unchecked usize multiplication in nnef/src/tensors.rs read_tensor for attacker-controlled tensor dimensions, the allocation size, and the reported tensor length.
A correctness issue was addressed with improved checks.
Concrete CMS 8.3.0 to 9.5.2 stored calendar event names without sanitization and rendered them without HTML escaping in the workflow approval and deletion notifications shown in the dashboard "Waiting For…
IBM Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001 and IBM Security Verify Access 10.0.0 through 10.0.9.2 Interim Fix 001 and IBM Verify Identity Access Container 11.0.0 through 11.0.3 Interim…
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to obtain ownership of arbitrary file system objects due to a time-of-check to time-of-use (TOCTOU) race condition.
An integer overflow was addressed with improved input validation.
A race condition was addressed with improved state management.
On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a low-privileged attacker on an adjacent network segment who…
langgraph-api implements the LangGraph API for rapid development and testing.
langgraph-api implements the LangGraph API for rapid development and testing.
A logic issue was addressed with improved checks.
IBM WebSphere Application Server 9.0, and 8.5 is affected by an authentication bypass vulnerability when using XD or Intelligent-Management features.
Zephyr's TLS socket layer in subsys/net/lib/sockets/sockets_tls.c keeps a single process-global array, client_cache, of cached client sessions that is shared by every TLS socket context.
Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by providing a public document UUID.
Every API method in src/Vault.js passes failed requests through parseAxiosError(), which rethrows the raw AxiosError while retaining AxiosError.config and the equivalent response configuration.
The routesrv component serves cluster-wide control-plane data without application-layer authentication through /routes, /routes/{zone}, /swarm/redis/shards, and /swarm/valkey/shards.
Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application.
A flaw was found in SSSD (System Security Services Daemon).
ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. has an Improper Access Control vulnerability.
ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. has an Untrusted Pointer Dereference vulnerability.
A vulnerability was detected in marcobambini Gravity up to 0.9.7.
A memory corruption issue was addressed with improved input validation.
This issue was addressed with improved state management.
A permissions issue was addressed with improved path validation.
This issue was addressed by removing the vulnerable code.
An out-of-bounds read was addressed with improved input validation.
A parsing issue in the handling of directory paths was addressed with improved path validation.
This issue was addressed with additional entitlement checks.
This issue was addressed with additional entitlement checks.
A path traversal issue was addressed with improved input validation.
A permissions issue was addressed with additional restrictions.
A privacy issue was addressed with improved handling of files.
A permissions issue was addressed with additional restrictions.
An authorization issue was addressed with improved state management.
An authorization issue was addressed with improved state management.
A permissions issue was addressed with improved path validation.
An authorization issue was addressed with improved access control.
A permissions issue was addressed with improved validation.
An authorization issue was addressed with improved state management.
A type confusion issue was addressed with improved memory handling.
An authorization issue was addressed with improved state management.
An authorization issue was addressed with improved access control.
A permissions issue was addressed with additional restrictions.
A type confusion issue was addressed with improved checks.
A permissions issue was addressed with improved state management.
A use after free issue was addressed with improved memory management.
A permissions issue was addressed with additional restrictions.
A permissions issue was addressed with additional restrictions.
An information disclosure issue was addressed with improved state management.
A permissions issue was addressed with improved state management.
A permissions issue was addressed with additional restrictions.
This issue was addressed with improved checks.
This issue was addressed with improved checks.
An access issue was addressed with additional sandbox restrictions on the system pasteboards.
The issue was addressed with improved memory handling.
A permissions issue was addressed with improved validation.
A double free issue was addressed with improved memory management.
An authorization issue was addressed with improved access control.
An authorization issue was addressed with improved access control.
The issue was addressed with improved memory handling.
An input validation issue was addressed with improved input validation.
An authorization issue was addressed with improved state management.
A path handling issue was addressed with improved validation.
A logging issue was addressed with improved data redaction.
A logging issue was addressed with improved data redaction.
An out-of-bounds write issue was addressed with improved bounds checking.
A use after free issue was addressed with improved memory management.
An integer overflow was addressed with improved input validation.
This issue was addressed with additional entitlement checks.
A privacy issue was addressed with improved private data redaction for log entries.
A permissions issue was addressed with additional restrictions.
A buffer overflow was addressed with improved bounds checking.
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7 fail to enforce authorization boundaries on the access control policy update endpoint which allows a channel or team administrator to…
A bug in how ZITADEL updates permissions when multiple project roles are deleted at the same time can cause some user permissions to be missed.
An integer overflow was addressed with improved input validation.
A path handling issue was addressed with improved validation.
A type confusion issue was addressed with improved memory handling.
An integer overflow was addressed with improved input validation.
A use after free issue was addressed with improved memory management.
A logic issue was addressed with improved validation.
A memory initialization issue was addressed with improved memory handling.
An authorization issue was addressed with improved state management.
This issue was addressed with improved checks.
A use after free issue was addressed with improved memory management.
A race condition was addressed with improved state handling.
A permissions issue was addressed with improved validation.
A parsing issue in the handling of directory paths was addressed with improved path validation.
An issue existed in the handling of snapshots.
A memory corruption issue was addressed with improved memory handling.
An out-of-bounds read was addressed with improved bounds checking.
A logic issue was addressed with improved state management.
This issue was addressed with improved checks.
An authorization issue was addressed with improved state management.
A permissions issue was addressed with additional restrictions.
A permissions issue was addressed with additional restrictions.
A path handling issue was addressed with improved validation.
A memory corruption issue was addressed with improved bounds checking.
A use-after-free issue was addressed with improved memory management.
A permissions issue was addressed with additional restrictions.
The issue was addressed with improved checks.
A logic issue was addressed with improved state management.
An authorization issue was addressed with improved validation.
An authorization issue was addressed with improved state management.
This issue was addressed with improved data protection.
An out-of-bounds write issue was addressed with improved bounds checking.
This issue was addressed through improved state management.
A use-after-free issue was addressed with improved memory management.
A logic issue was addressed with improved checks.
DocsGPT through 0.20.0 posts OAuth connector session tokens to a wildcard target origin in the callback-status endpoint without validating sender origin.
Trilium Notes, version v0.103.0 and earlier, contains a stored cross-site scripting (XSS) vulnerability in the share renderer for webView notes due to improper HTML escaping of user-controlled #webViewSrc…
LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content during media upload, allowing authenticated users with only the media.create permission to upload malicious SVG files containing…
A vulnerability has been found in GPAC up to f1219cde.
A logic issue was addressed with improved state management.
An authorization issue was addressed with improved state management.
An out-of-bounds read issue was addressed with improved input validation.
SolarView Compact contains a cross-site scripting vulnerability in Image Management.
SolarView Compact contains a cross-site scripting vulnerability in Schedule Settings and Mail Send Setting.
Cross-site scripting vulnerability exists in PC-HELPER Wireless I/O DIO-0404RY-LWF and PC-HELPER Wireless I/O DIO-0404RY-LWF-US.
Cross-site scripting vulnerability exists in CONPROSYS nano Series.
Cross-site scripting vulnerability exists in Contec EC1000 series.
Cross-site scripting vulnerability exists in Contec RP-WAH-SR Series.
Cross-site scripting vulnerability exists in Contec FX5000 series, FX4000 series, and FX3000 series.
Concrete CMS versions 9.0.0 to 9.5.2 stored the Page Container icon value submitted through the dashboard without validating it against the set of known container icons.
IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 allows a non-privileged user to edit their given name and surname to include malicious JavaScript code.
IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 could allow a remote authenticated attacker to perform UI spoofing and phishing attacks due to improper neutralization of user-supplied HTML markup.
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels.
IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6_2, 6.2.1.0 - 6.2.1.2, 6.2.2.0 - 6.2.2.1 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.6_2, 6.2.1.0 - 6.2.1.2, 6.2.2.0 - 6.2.2.1 Standard Edition…
Concrete CMS 9.0.0 through 9.5.3 is vulnerable to stored XSS via the custom page alias name (customAliasName) because the Edit Alias dialog applied only trim() to the submitted value and performed no input…
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to change the password of an account due to improper authentication.
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive information due to improper request validation.
IBM WebSphere Application Server 9.0, and 8.5 is affected by a reflected cross-site scripting vulnerability.
IBM WebSphere Application Server 9.0, and 8.5 is affected by blind server-side request forgery when processing SOAP requests.
IBM Verify Identity Access is missing origin validation which could allow a remote attacker to perform operations as the victim and potentially launch further attacks against the systems.
IBM Langflow OSS 1.0.0 through 1.11.2 is vulnerable to server-side request forgery (SSRF).
IBM Cloud Pak for Business Automation could allow a remote attacker to bypass authorization and invoke restricted endpoints due to improper validation of HTTP headers.
GrowthBook through 5.0.1 returns unredacted fact table definitions including raw warehouse SQL in payloads served by unauthenticated public report and experiment endpoints.
novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to invalidate portal caches by supplying the…
A vulnerability was detected in GNU Binutils 2.47.
A security vulnerability has been detected in GNU Binutils 2.47.
A weakness has been identified in GNU Binutils 2.47.
A security flaw has been discovered in GNU Binutils 2.47.
A security vulnerability has been detected in GNU Binutils 2.47.
A security flaw has been discovered in GNU Binutils 2.47.
A vulnerability was determined in Dvidelabs flatcc up to 0.6.3.
A vulnerability was found in Dvidelabs flatcc up to 0.6.3.
A vulnerability has been found in Dvidelabs flatcc up to 0.6.3.
A security flaw has been discovered in memcached 1.6.41/1.6.42/1.6.43.
A vulnerability was found in GPAC up to f1219cde.
A security vulnerability has been detected in Matthias-Wandel jhead up to 3.3.
When a request using disk storage is aborted mid-upload, file writes that complete after multer has already run its abort cleanup are not removed, so each aborted upload can leave an orphaned file on disk.
Joomla Extension - regularlabs.com - Reflected XSS in Articles Anywhere extension for Joomla < 20.0.0, Users Anywhere extension for Joomla < 2.1.0 - Articles Anywhere Pro and Users Anywhere Pro return…
A cryptographic issue was addressed with improved integrity checks.
Yealink SIP-T33G firmware versions 124.86.x.x prior to 124.87.0.0 contain a race condition vulnerability that allows authenticated attackers to interrupt active diagnostic processes by concurrently deleting…
4.3.15, and 5.0.0-preview09-final, applications with configured file upload storage allow unauthenticated users to submit files directly to DotvvmFileUploadMiddleware without an X-DotVVM-UploadToken…
Session.parseNextCapsule() in session.go skips an unknown WebTransport capsule on the HTTP/3 request stream by calling io.ReadAll on the capsule reader, retaining the complete declared capsule body in memory.
ModelView.sort_query in sqladmin/models.py accepts the attacker-controlled sortBy list-view query parameter without enforcing the configured column_sortable_list server-side allow-list in self._sort_fields.
HTTPServer.ServeHTTP in internal/wasm/httpserver.go reads the plain mappingPath2Cache map without synchronization while HTTPServer.Get writes the same map during EnvoyExtensionPolicy translation.
ExifReader.load() and the asynchronous file and URL loaders can pass attacker-supplied HEIC or AVIF data to the ISO-BMFF parser in src/image-header-iso-bmff.js, where findMetaBox() and parseBox() accept an…
The Sentry exporter reads the remote OTLP sender-controlled service.name resource attribute in exporter/sentryexporter/sentry_exporter.go through extractProjectSlug and getOrCreateProjectEndpoint, passes…
An authorization issue was addressed with improved entitlement checks.
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to gain access to sensitive information through session IP binding bypass in Navigator for i.
IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log.
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads, which allows an unauthenticated…
An out-of-bounds write issue was addressed with improved bounds checking.
Cross-site scripting vulnerability exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit.
Cross-site scripting vulnerability exists in SGA1000.
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a denial of service as a result of a buffer overflow in a PASE process.
Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox.
MISP contains a Cross-Site Request Forgery (CSRF) vulnerability in the UserSettingsController.
The Android application "YAMAP -Social Trekking GPS App" contains an improper access control vulnerability in its WebView implementation.
Cross-site request forgery vulnerability exists in multiple Contec products.
Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 - The add-to-menu routine invoked the com_menus item model's save() method…
Refly through 1.1.0 contains a server-side request forgery vulnerability in the POST /v1/misc/scrape endpoint that fetches caller-supplied URLs without validating the scheme, host, or resolved address.
FROM_PY in asteval/astutils.py exposes BaseException, SystemExit, KeyboardInterrupt, and GeneratorExit to expressions evaluated by asteval.Interpreter.eval(), while run() and eval() in asteval/asteval.py…
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate channel action ownership which allows channel managers to update actions in other channels via…
Exposure of sensitive information through data queries vulnerability in Apache Syncope.
Insufficiently Protected Credentials vulnerability in Apache Syncope.
A vulnerability was detected in GNU Binutils 2.47.
A certificate validation issue was addressed with improved certificate validation.
IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log.
A security flaw has been discovered in magicblack MacCMS10 2026.1000.4055.
A security vulnerability has been detected in Yot CMS up to 3.3.1.
A race condition was addressed with improved state handling.
A race condition was addressed with additional validation.
A race condition was addressed with additional validation.
A race condition was addressed with improved state handling.
A race condition was addressed with improved state handling.
A race condition was addressed with improved state handling.
A race condition was addressed with improved locking.
IBM Verify Identity Access could allow a remote attacker to conduct phishing attacks, using an open redirect attack.
Affected versions of MISP’s interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging.
A logic issue was addressed with improved checks.
An authentication issue was addressed with improved state management.
The ITE it82xx2 USB device-controller driver initialized its bus-suspend detection work with k_work_init_delayable(&priv->suspended_work, suspended_handler) inside it82xx2_enable() (the driver's .enable op)…
The Zephyr SDIO subsystem function sdio_io_rw_extended_helper() in subsys/sd/sdio.c finishes transfers with a byte-I/O loop that uses size = MIN(remaining, func->cis.max_blk_size) as the per-iteration step.
A weakness has been identified in GNU Binutils 2.47.
A logic issue was addressed with improved state management.
A permissions issue was addressed with improved state management.
A logic issue was addressed with improved checks.
A logic issue was addressed with improved validation.
A file quarantine bypass was addressed with additional checks.
This issue was addressed with improved checks.
novel-plus through 5.3.3 contains an authorization bypass vulnerability in the BookController download endpoint that allows authenticated backend accounts to export complete book text including paid chapters.
Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customer_email.php.
Froxlor before 2.3.7 fails to validate the mysql_server parameter against a customer's allowed_mysqlserver allowlist in the Mysqls.add API command.
EspoCRM before 10.0.4 contains a field-level security bypass vulnerability in the meeting and call attendees endpoints that allows authenticated users to read restricted email addresses.
A security vulnerability has been detected in a2aproject a2a-java 1.2.0.
A security flaw has been discovered in netease-youdao LobsterAI 2026.6.15/2026.8.28/2026.9.3/2026.9.4.
A vulnerability was found in FFmpeg 8.0.x.
A vulnerability was detected in cosmicstack-labs mercury-agent up to 1.1.13.
A security vulnerability has been detected in cosmicstack-labs mercury-agent up to 1.2.0.
A vulnerability was determined in itsourcecode Loan Management System 1.0.
A flaw has been found in GPAC up to f1219cde.
A vulnerability was identified in Gitlawb openclaude up to 0.30.0.
A vulnerability was identified in SourceCodester Inventory Management System 1.0.
A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0.
Publishing limits the compressed size of a VSIX (ovsx.publishing.max-content-size, 512 MB by default) but nothing limited how large an entry becomes when opened.
MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ builder function that allows authenticated users to crash…
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.8, 10.11.x <= 10.11.22 fail to limit the nesting depth in the server-side Markdown parser which allows an authenticated attacker to…
Mattermost versions <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics, which allows an authenticated user to crash the plugin via a post-action request with an unexpected field type..
A buffer overflow was addressed with improved bounds checking.
An uninitialized memory issue was addressed with improved memory initialization.
An out-of-bounds write issue was addressed with improved bounds checking.
An out-of-bounds read was addressed with improved bounds checking.
This issue was addressed through improved state management.
Stack-based buffer overflow vulnerability exists in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*.
Out-of-bounds write vulnerability exists in CONPROSYS nano Series.
An exposure of information through directory listing issue exists in CONPROSYS PAC Series.
An exposure of information through directory listing issue exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series.
Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attackers to bypass enforced two-factor authentication…
Description The Logviewer offers `logs.users` and `logs.groups` so operators can control who may read log content.
IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 could allow a remote authenticated attacker to view administrative user interface components due to client-side authorization bypass.
An information disclosure issue was addressed with improved state management.
An information disclosure issue was addressed with improved state management.
The SSE server in src/praisonai-agents/praisonaiagents/server/server.py does not consult ServerConfig.auth_token before handling /publish, /events, or /info requests.
Handler in dataclients/kubernetes/admission/admission.go passes the body of requests to the Kubernetes admission endpoint at :9443/admission directly to io.ReadAll(r.Body) without a size limit.
An out-of-bounds write issue was addressed with improved bounds checking.
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to place files into the file system with Navigator for i when they should be blocked by Navigator configuration.
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to improper validation of the WebSocket origin.
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce the board-creation permission which allows an unauthorized authenticated user to create boards…
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce board creation permissions when importing archive files which allows an authenticated non-guest…
Mattermost Advisory ID: MMSA-2026-00710
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to parse Markdown autolinks with unmatched trailing closing parentheses in linear time, which allows an…
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to properly enforce the limit of concurrent files being processed and handled failed files, which allows a…
Plaintext storage of a password issue exists in CONPROSYS nano Series .
TripleLift's ad rendering script (video-bundle.js) contains a DOM-based cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a publisher's domain by…
An issue was discovered in CustOS Driver in Samsung Mobile Processor Exynos 1580.
An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600.
An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600.
An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, and 1380.
An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600.
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race condition during the WebSocket handshake process.
IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to access another user's MCP server context due to improper cache key isolation in the MCP Tools component.
A flaw was found in sssd.
A flaw was found in sssd, specifically within the PAM (Pluggable Authentication Modules) responder's protocol v1 parser, pam_parse_in_data().
A flaw was found in the sssd NSS responder.
An issue was discovered in NR RRC in Samsung Mobile Processor and Modem Exynos 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, W1000, Modem 5300, Modem 5400, and Modem 5410.
A weakness has been identified in andreashappe cochise up to 0.4.1.
SpiceDB can return PERMISSIONSHIP_HAS_PERMISSION instead of PERMISSIONSHIP_CONDITIONAL_PERMISSION or PERMISSIONSHIP_NO_PERMISSION because checkRequestToKey() and checkRequestToKeyWithCanonical() in…
A malicious state-sync peer can crash a syncing node by sending a crafted TrieChunk whose proof contains a TrieNodeChild suffix that is individually valid but exceeds the 63-byte KeyNibbles backing array…
A malicious state-sync peer can crash a syncing node by sending a crafted TrieChunk proof containing two TrieProofNode values with identical keys.
The TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group.
A flaw has been found in michaelliao itranswarp up to 2.19.
A vulnerability was determined in SourceCodester Inventory Management System 1.0.
A vulnerability was found in SourceCodester Inventory Management System 1.0.
A vulnerability has been found in SourceCodester Inventory Management System 1.0.
A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046.
An authorization issue was addressed with improved state management.
An issue was discovered in NR RRC and L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 1680, W920, W930, W1000, and Modem…
An issue was discovered in Samsung Mobile Processor Exynos 1330, 1380, 1480, and 2400.
A vulnerability was identified in GPAC 26.07.0.
A vulnerability was found in GPAC 26.07.0.
A vulnerability has been found in GPAC 26.07.0.
A weakness has been identified in cosmicstack-labs mercury-agent up to 1.2.0.
A security flaw has been discovered in vllm-project vLLM up to 0.29.0.
A vulnerability was detected in GPAC up to f1219cde.
A weakness has been identified in Matthias-Wandel jhead up to 3.3.
A security flaw has been discovered in GNU libredwg 0.13.4.
A security flaw has been discovered in GPAC up to f1219cde.
A vulnerability was identified in GPAC up to f1219cde.
A vulnerability was determined in GPAC up to f1219cde.
A vulnerability was found in GPAC up to f1219cde.
A vulnerability has been found in GPAC up to f1219cde.
A permissions issue was addressed with additional restrictions.
A permissions issue was addressed with additional restrictions.
A privacy issue was addressed by removing sensitive data.
An information disclosure issue was addressed with improved state management.
An information disclosure issue was addressed with improved memory management.
This issue was addressed with improved redaction of sensitive information.
@openzeppelin/wizard-cairo 3.0.1, @openzeppelin/wizard-stellar 0.6.2, and @openzeppelin/wizard-stylus 0.3.1, the setInfo code path prints info.securityContact and info.license verbatim into single-line…
October System provides the system module for October Content Management System.
October System provides the system module for October Content Management System.
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a denial of service as a result of a buffer overflow in a PASE process.
IBM WebSphere Application Server 9.0, and 8.5 is affected by an authorization bypass vulnerability.
The listen address of the MCP server in HTTP mode is 0.0.0.0.
A vulnerability was determined in GPAC 26.07.0.
A vulnerability has been found in GPAC up to f1219cde.
A flaw has been found in GPAC up to f1219cde.
An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680.
An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680.
An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680.
An issue was discovered in Wi-Fi in Samsung Mobile Processor Exynos 850, 1280, 1330, 1380, 1480, 2400, W920, and W930.
An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 1580, 1680, W920, W930, and W1000. .
An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, and 2500.
An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600.
The in_s3 input plugin reads the entire decompressed payload of gzip, lzma2, and lzop objects into memory without enforcing a decompression_size_limit.
An authenticated supplicant on an adjacent network may bypass intended network authorization policy and send unrestricted traffic during a brief window (milliseconds to seconds) between the completion of…
A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued.
A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system.
A brief (milliseconds to seconds) traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CLI command or due to a supplicant timeout.