97,131 results · Clear filters · Feed
-
High 8.1
GRR has a Reflected XSS issue
GRR is a resource management and reservation application. Prior to version 4.5.0, `maj.php` reflects the `forcemaj` parameter without adequate escaping when installation files remain accessible. Removal of these files is not automatic. An attacker can craft a…
-
High 7.0
Asterisk: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the `PostgreSQL` and `TDS/MSSQL` Channel Event Log backends `cel_pgsql` and `cel_tds`…
-
High 7.5
Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net
When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated …
-
High 7.5
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
-
High 8.2
Asterisk: Stack buffer overflow in MWI NOTIFY Message-Account parsing
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded `sscanf` in `res_pjsip_pubsub` when parsing the `MWI NOTIFY` `Message-Ac…
-
High 7.5
Asterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser
Asterisk is an open source private branch exchange and telephony toolkit. From 21.0.0-pre1 until Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, the `chan_ooh323` `Q.931 party-number parser` lacks the `CVE-2022-37325` fix because that fix…
-
High 7.5
Asterisk: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, an authenticated attacker with read-only permissions for the `Asterisk REST Interface (ARI)` may, …
-
High 7.5
Asterisk: NULL Pointer Dereference in HTTP AMI Digest Authentication
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a NULL pointer dereference in the `Asterisk Manager Interface (AMI)` may allow an una…
-
High 8.8
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
-
High 8.7
dd-trace: ReDOS in URL query string obfuscation
dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can perform excessive backtracking on attacker-controlled URL query strings. The expression is applied synchronously whil…
-
High 8.8
Sunhillo SureLine OS Command Injection via networkDiag.cgi
Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in the networkDiag.cgi endpoint that allows an authenticated remote attacker with any web account to execute arbitrary commands as root by injecting shell metacharacters into the ip…
-
High 7.5
Sunhillo SureLine Path Traversal via radarUpdater.cgi
Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the radarUpdater.cgi endpoint that allows unauthenticated remote attackers to read arbitrary files with root privileges due to missing authentication checks and insufficient sanitizatio…
-
High 7.5CVE-2026-116690 Scanner template
MLflow: Arbitrary file read on unauthenticated MLflow servers via prompt model version source
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.10.0 until 3.17.0, the prompt branch in _create_model_version() accepts schemeless relative sources because path validation runs only when …
-
High 8.1
CKEditor: Cross-site scripting (XSS) in the engine package
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes incoming style attribu…
-
High 7.5
MembershipWorks WordPress Plugin < 6.17 Information Disclosure via WordPress REST API
The MembershipWorks plugin for WordPress before 6.17 contains an information disclosure vulnerability that allows unauthenticated attackers to access member-only content through the WordPress REST API. Because the filter that strips protected content for non-…
-
High 7.1
CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values
CTFer.io's CTFd Terraform Provider manages CTFd resources as code. From 0.1.5 until 2.8.2, ctfd_team.password is stored as a non-sensitive value in Terraform state. A local or remote user with access to that state can read the team password without an additio…
-
High 7.5
Matrix homeserver could redirect the chat session to a local file or network share
When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it. A malicious or compromised homeserver could provide a file: URL, causing Thunderbird to send all further Matrix request…
-
High 8.8
Request forgery via news: links
Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was not a configured news server. Line breaks in the message-ID were sent to the server unmodified, so a …
-
High 8.1
Bypass of remote UNC path restriction in mailbox: URLs
Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths. Displaying a specially crafted email could cause Thunderbird to connect to an SMB server chosen by the att…
-
High 7.5
Content of other messages could be included when replying to a crafted message
When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into the message being composed, without showing a blocked content warning. If the user sent the message, t…
-
High 7.8
AWS API MCP Server OAuth Token Audience Validation Bypass
Missing token audience validation in the OAuth authentication mode of AWS API MCP Server before version 1.6.0 might allow local users to run AWS operations with the server's configured AWS credentials via an access token issued to another application by the s…
-
High 8.1
Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated Asterisk REST Interface (ARI) attacker with read-only privileges may…
-
High 7.1
Asterisk: Stack buffer overflow in res_xmpp XMPP namespace prefix handling
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a stack buffer overflow in `res_xmpp` `XMPP names…
-
High 8.6
FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directory
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves symbolic links through GetRealPath without confirming that the resolved target remai…
-
High 7.8
X.Org Server XKB SetGeometry TextDoodad Double Free
A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially code in the x server context.
-
High 8.7
Improper Authentication in TP-Link TDDP v2 Allows Root Command Execution in TP-Link RE305
An authentication weakness exists in the TP-Link TDDP v2 service of TP-Link RE305 V3. TDDP v2 uses a fixed and derivable cryptographic key, which may allow an unauthenticated attacker on the same local network to forge protocol packets and access privileged T…
-
High 8.8
Tanium addressed an unauthorized code execution vulnerability in Certificate Manager.
Tanium addressed an unauthorized code execution vulnerability in Certificate Manager.
-
High 7.8
Tanium addressed a local privilege escalation vulnerability in End-User Notifications.
Tanium addressed a local privilege escalation vulnerability in End-User Notifications.
-
High 7.5
Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.
Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.
-
High 8.8
Tanium addressed an unauthorized code execution vulnerability in Threat Response.
Tanium addressed an unauthorized code execution vulnerability in Threat Response.
-
High 7.8
Tanium addressed a local privilege escalation vulnerability in End-User Notifications.
Tanium addressed a local privilege escalation vulnerability in End-User Notifications.
-
High 7.5
Tanium addressed a denial of service vulnerability in Provision.
Tanium addressed a denial of service vulnerability in Provision.
-
High 7.1
Tanium addressed an improper output sanitization vulnerability in Enforce.
Tanium addressed an improper output sanitization vulnerability in Enforce.
-
High 7.1
Tanium addressed an improper output sanitization vulnerability in Comply.
Tanium addressed an improper output sanitization vulnerability in Comply.
-
High 7.8
Tanium addressed a heap-based buffer overflow vulnerability in Index.
Tanium addressed a heap-based buffer overflow vulnerability in Index.
-
High 7.8
Tanium addressed a local privilege escalation vulnerability in End-User Notifications.
Tanium addressed a local privilege escalation vulnerability in End-User Notifications.
-
High 7.5
Tanium addressed a compression bomb vulnerability in Enforce.
Tanium addressed a compression bomb vulnerability in Enforce.
-
High 7.3
oretnom23 php-travel-agency-system Contact Form contact_insert.php sql injection
A weakness has been identified in oretnom23 php-travel-agency-system. The affected element is an unknown function of the file contact_insert.php of the component Contact Form Handler. This manipulation of the argument name/company/email/topic/phone/comments c…
-
High 7.3
oretnom23 php-travel-agency-system traceapplication.php sql injection
A security flaw has been discovered in oretnom23 php-travel-agency-system 4e28b8f84d72420373dd15c3ae32900beb7e0635. Impacted is an unknown function of the file traceapplication.php. The manipulation of the argument Search results in sql injection. It is possi…