35,485 results · Clear filters · Feed
-
Medium 5.5CVE-2026-112705 Public exploit
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS …
-
High 8.8CVE-2026-112688 Public exploit
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7,…
-
Medium 6.1CVE-2026-112611 Public exploit
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS …
-
High 8.4CVE-2026-112689 Public exploit
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS…
-
High 7.8CVE-2026-112487 Public exploit
A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequ…
-
High 7.3CVE-2026-116580 Public exploit
Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON rebuilds an AsyncIteratorFactoryInstance by calling source.on(listener) without requiring source to be a genuine in…
-
Medium 5.5CVE-2026-112706 Public exploit
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iO…
-
Critical 9.9CVE-2026-110720 Public exploit
Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules
Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtain elevated Consul privileges. This vulnerability (CVE-2026-110720) is fixed in consul-k8s 2.1.0 and…
-
Medium 4.3CVE-2026-116471 Public exploit
BKWLD Decoy Authorization Policy Policy.php privileges management
A security flaw has been discovered in BKWLD Decoy up to 5.11.1. The impacted element is an unknown function of the file Policy.php of the component Authorization Policy. The manipulation of the argument role results in improper privilege management. The atta…
-
Critical 10.0CVE-2026-115905 Public exploit
zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE
zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling th…
-
Medium 6.3CVE-2026-116370 Public exploit
2K Games Sid Meier's Civilization VI Lua sandbox loadstring type confusion
A security flaw has been discovered in 2K Games Sid Meier's Civilization VI 1.0.12.68. The affected element is the function loadstring of the component Lua sandbox. Performing a manipulation results in type confusion. The attack may be initiated remotely. The…
-
High 7.5CVE-2026-90885 Public exploit
Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was Resolved
Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. XQueryBuilder in camel-saxon, which evaluates expressions for the xquery…
-
Medium 4.8CVE-2026-94386 Public exploit
Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token Cache
Use of Cache Containing Sensitive Information vulnerability in Apache Camel Oauth component. This issue affects Apache Camel: from 4.19.0 before 4.22.2. OAuthClientCredentialsTokenResolver obtains OAuth 2.0 bearer tokens through the client credentials grant o…
-
Critical 9.3CVE-2026-93328 Public exploit
Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write
Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storag…
-
Medium 6.8CVE-2026-116488 Public exploit
NXP MCUXpresso SDK USB Middleware before 2.13.0 Heap Overflow via Host Class Drivers
NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied bNumEndpoints and bLength values. A malicious USB device can supply crafted descript…
-
Medium 4.6CVE-2026-116487 Public exploit
NXP MCUXpresso SDK USB Middleware before 2.13.0 RNDIS Out-of-Bounds Read
NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains an out-of-bounds read vulnerability in USB_DeviceCdcRndisSetCommand() that trusts a host-supplied informationBufferOffset. A malicious USB host can send RNDIS SET messages for O…
-
Critical 9.1CVE-2026-116214 Public exploit
MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code
MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via use…
-
Medium 5.4CVE-2026-95628 Public exploit
Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047)
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Docling component. This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.2. DoclingProducer builds the command line of t…
-
Medium 5.4CVE-2026-95629 Public exploit
Apache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Output to an Arbitrary Directory
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Docling component. This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.2. DoclingProducer runs the external docling to…
-
Medium 4.8CVE-2026-95663 Public exploit
Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token Expiry
Insufficient Session Expiration vulnerability in Apache Camel Keycloak component. This issue affects Apache Camel: from 4.16.0 before 4.18.5, from 4.19.0 before 4.22.2. When token introspection is enabled on the camel-keycloak KeycloakSecurityPolicy (useToken…
-
Medium 5.4CVE-2026-95664 Public exploit
Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel AWS2-s3 component. This issue affects Apache Camel: from 4.8.0 before 4.18.5, from 4.19.0 before 4.22.2. For t…
-
Medium 5.3CVE-2026-101259 Public exploit
Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions
Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CoAP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. When the CoAP consumer could not build its response once the route…
-
Medium 6.3CVE-2026-116111 Public exploit
2K Games Civilization V Lua Sandbox loadstring type confusion
A vulnerability was determined in 2K Games Civilization V 1.0.3.144. Impacted is the function loadstring of the component Lua Sandbox. Executing a manipulation can lead to type confusion. The attack may be performed from remote. The exploit has been publicly …
-
High 7.3CVE-2026-116106 Public exploit
HeyCyan App FileProvider access control
A security vulnerability has been detected in HeyCyan App 1.0.103 on Android. Affected by this vulnerability is an unknown functionality of the component FileProvider. The manipulation leads to improper access controls. The attack may be initiated remotely. T…
-
Low 3.7CVE-2026-116105 Public exploit
HeyCyan App Network Security Configuration AndroidManifest.xml cleartext transmission
A weakness has been identified in HeyCyan App 1.0.103 on Android. Affected is an unknown function of the file AndroidManifest.xml of the component Network Security Configuration. Executing a manipulation can lead to cleartext transmission of sensitive informa…
-
High 7.8CVE-2026-106781 Public exploit
An issue in WCH CH340/CH341 USB-to-Serial Windows Driver setup package CH341SER.EXE version 4.0 allows a local attacker…
-
Critical 9.8CVE-2026-31158 Public exploit
SQL Injection vulnerability in CRM SOFTTRADE Infotech (aka softtradeindia) 1.0 allows a remote attacker to execute arbi…
-
Critical 9.8CVE-2026-107092 Public exploit
NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint.
-
Medium 4.7CVE-2026-116063 Public exploit
DedeCMS update_guide.php require_once code injection
A weakness has been identified in DedeCMS up to 5.7.118. Impacted is the function require_once of the file dede/update_guide.php. This manipulation of the argument vtime causes code injection. Remote exploitation of the attack is possible. The exploit has bee…
-
High 7.5CVE-2026-116191 Public exploit
Rclone before 1.75.2 Path Traversal via serve webdav MKCOL
Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, …
-
Low 3.5CVE-2026-116004 Public exploit
onyx-dot-app Onyx PreviewTab.tsx cross site scripting
A security vulnerability has been detected in onyx-dot-app Onyx up to 5.0.0. Impacted is an unknown function of the file web/src/app/craft/components/output-panel/PreviewTab.tsx. The manipulation leads to cross site scripting. The attack can be initiated remo…
-
High 7.3CVE-2026-116000 Public exploit
Zylon PrivateGPT URI Artifact Loader uri_loader.py load_file_from_uri server-side request forgery
A security flaw has been discovered in Zylon PrivateGPT 1.0.0/1.0.1. This vulnerability affects the function load_file_from_uri of the file private_gpt/server/ingest/uri_loader.py of the component URI Artifact Loader. Performing a manipulation of the argument…
-
Critical 9.1CVE-2026-114820 Public exploit
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
High 7.5CVE-2026-116011 Public exploit
Crow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()
Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exha…
-
Low 3.6CVE-2026-116012 Public exploit
Ghidra before 12.2 Integer Truncation in PackedDecode::skipAttribute Decompiler Parser
Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that stores 64-bit string lengths in 32-bit variables. Attackers can supply a crafted packed stream, such as a malicious .sl…
-
Critical 9.3CVE-2026-112866 Public exploit
WordPress Product Filter by WBW plugin <= 3.4.6 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL Injection.This issue affects Product Filter by WBW: from n/a through 3.4.6.
-
High 7.1CVE-2026-112869 Public exploit
WordPress We’re Open! plugin <= 2.6 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Hearle We’re Open! opening-hours allows Reflected XSS.This issue affects We’re Open!: from n/a through 2.6.
-
Critical 9.9CVE-2026-115893 Public exploit
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. …
-
Critical 9.9CVE-2026-115889 Public exploit
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with ma…
-
High 7.4CVE-2026-106069 Public exploit
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP addre…