25,540 results · Clear filters · Feed
-
Critical 10.0
TOTOLINK A950RG Device-Information CGI infostat.cgi sub_402340 stack-based overflow
A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function sub_402340 of the file infostat.cgi of the component Device-Information CGI. Performing a manipulation of the argument CONTENT_LENGTH results…
-
Critical 9.9
TOTOLINK A950RG firewall.so apmib_set command injection
A vulnerability was determined in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected is the function apmib_set of the file firewall.so. This manipulation causes command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and…
-
Critical 9.1
TOTOLINK A950RG device-information udhcpd.leases getDeviceInfo command injection
A vulnerability was found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function getDeviceInfo of the file /var/lib/misc/udhcpd.leases of the component device-information Handler. The manipulation of the argument MAC address results in command i…
-
Critical 9.8
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2…
-
Critical 9.8
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, …
-
Critical 9.1
A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7…
-
Critical 9.3
A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Seq…
-
Critical 9.8
This issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 …
-
Critical 9.0
A path traversal issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27. An app…
-
Critical 9.0
An out-of-bounds read issue was addressed by removing the vulnerable code. This issue is fixed in macOS Golden Gate 27.…
-
Critical 9.0
This issue was addressed with improved permissions checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequo…
-
Critical 9.8
A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Seq…
-
Critical 9.1
The issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27.2, macOS Tahoe 26.7.…
-
Critical 10.0
This issue was addressed by removing the vulnerable code. This issue is fixed in Safari 27.2, iOS 27.2 and iPadOS 27.2,…
-
Critical 9.9
TOTOLINK A950RG Cloud Upgrade upgrade.so setCloudUpgradeFW command injection
A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setCloudUpgradeFW of the file lib/cste_modules/upgrade.so of the component Cloud Upgrade. The manipulation of the argument FileName leads to command injection.…
-
Critical 9.9CVE-2026-110720 Public exploit
Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules
Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtain elevated Consul privileges. This vulnerability (CVE-2026-110720) is fixed in consul-k8s 2.1.0 and…
-
Critical 9.8
BUG-000187511 - ArcGIS Server has a security vulnerability.
There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with privileges to access the service (which could, depending on the service being configured in a non-default access …
-
Critical 9.9
Burrito: Unauthenticated webhooks trigger unauthorized Terraform plans when webhookSecret is unset
Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator. Prior to 0.13.0, `POST /api/webhook` accepts unsigned GitHub and GitLab events when a `TerraformRepository`'s credentials omit `webhookSecret` or set it to an empty value, i…
-
Critical 10.0CVE-2026-115905 Public exploit
zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE
zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling th…
-
Critical 9.8
OpenHands Software Agent SDK < 1.52.0 Unauthenticated Sandbox Agent Server RCE
OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_…
-
Critical 9.3
Improper Privilege Assignment in boneIO
boneIO black_debian_images gives the boneio service account excessive privileges, including full passwordless sudo access and membership in the docker group. A local attacker who compromises the boneio user can use these privileges to escalate to root. This i…
-
Critical 9.3CVE-2026-93328 Public exploit
Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write
Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storag…
-
Critical 9.8
Avocent ACS8000 wsserver command injection
The root-privileged `wsserver` terminal-bridge daemon builds a shell command from client-supplied WebSocket fields and passes it to `system()` and `popen()` without quoting, escaping, or character-set validation. The daemon's public-key session path performs …
-
Critical 9.1
Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney
Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds {partial_ch…
-
Critical 9.6
An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6,…
-
Critical 9.8
Shared SSH Authentication Key in vSolution Matrix File Sharing
A security vulnerability has been identified in the vSolution Matrix file sharing feature. A shared cryptographic trust configuration could allow an attacker who obtains the matching private key to authenticate to an affected device via SSH as root. This vuln…
-
Critical 9.8
Unauthenticated RCE Vulnerability in WolfProt interface implementation
A security vulnerability has been identified in the WolfProt interface implementation. Insufficient neutralization of user-controlled input could allow an unauthenticated attacker with network access to a vulnerable service to execute operating-system command…
-
Critical 9.8CVE-2026-116485 Scanner template
danmu_api before 1.21.7 Authentication Bypass via Default Token in Env Endpoints
danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configuration when the default TOKEN is used and ADMIN_TOKEN is unset. Attackers can send POST requests to /api/env/set,…
-
Critical 9.1CVE-2026-116214 Public exploit
MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code
MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via use…
-
Critical 9.9
An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploade…
-
Critical 9.3
Improper Authentication Vulnerability in CreditNirvana Collections Platform
This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the platform login service. An unauthenticated remote attacker could exploit this vulnerability by manipulating authentication req…
-
Critical 9.1
Oray Pugongying X5 Pro L2TP Authentication crlf injection
A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Authentication. This manipulation of the argument Username causes crlf injection. The attack may be initiated remotely. The…
-
Critical 9.1
Oray Pugongying X5 Pro IPsec Policy ipsec.conf crlf injection
A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1. Affected is an unknown function of the file /etc/ipsec.conf of the component IPsec Policy Handler. The manipulation of the argument secproto results in crlf injection. The attack can be launched re…
-
Critical 9.1
Oray Pugongying X5 Pro Dnsmasq crlf injection
A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the component Dnsmasq. The manipulation of the argument rent_time leads to crlf injection. The attack can be initiated remotely. The exploit has be…
-
Critical 9.9
Oray Pugongying X5 Pro SNMP snmp_set crlf injection
A weakness has been identified in Oray Pugongying X5 Pro 7.6.1. This affects the function snmp_set of the component SNMP Handler. Executing a manipulation of the argument info.community can lead to crlf injection. It is possible to launch the attack remotely.…
-
Critical 9.9
Oray Pugongying X5 Pro Ser2net crlf injection
A security flaw has been discovered in Oray Pugongying X5 Pro 7.6.1. The impacted element is an unknown function of the component Ser2net. Performing a manipulation of the argument regmsg results in crlf injection. It is possible to initiate the attack remote…
-
Critical 9.8CVE-2026-31158 Public exploit
SQL Injection vulnerability in CRM SOFTTRADE Infotech (aka softtradeindia) 1.0 allows a remote attacker to execute arbi…
-
Critical 9.8CVE-2026-107092 Public exploit
NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint.
-
Critical 9.1
Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections
Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and …
-
Critical 9.1
YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API
YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries search API are…