97,136 results · Clear filters · Feed
-
High 7.1
Sensitive Data Exposure in extension "TYPO3 AI Integration Extension" (ns_t3ai)
In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at the expe…
-
High 8.6
A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execu…
-
High 8.6
A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with privileges on the …
-
High 8.7
Cross-Site WebSocket Hijacking in Google Cloud Shell
A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an unauthenticated attacker to hijack an active Cloud Shell session and exfiltrate the user's OAuth access token using a cross-origin WebSocket r…
-
High 8.6
A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated at…
-
High 7.5
A heap-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execut…
-
High 8.2
A vulnerability could allow an attacker to send a crafted message to trigger an assertion fault, causing the service to…
-
High 8.2
A vulnerability could allow an authenticated attacker to write files to arbitrary locations on the system.
-
High 8.2
A path traversal vulnerability could allow an authenticated attacker to read arbitrary files on the system.
-
High 8.6
A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the sys…
-
High 8.2
A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without r…
-
High 8.6
A stack-based buffer overflow vulnerability in a non-functional feature could allow an authenticated attacker to achiev…
-
High 7.5
Improper Signature Verification of Active Update Files
A failure has been identified in the SNS during dynamic data files signature check. A logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine.
-
High 8.7
A NULL pointer dereference vulnerability in the logs management functionality could allow an unauthenticated attacker t…
-
High 8.1
Apache Arrow C++, PyArrow: Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation
Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects users who read Parquet files and configure Parquet decryption properties with a KmsClient implementation. On the reader side, the KMS …
-
High 7.5
A buffer overflow vulnerability in the password verification functionality could allow an attacker with guest authentic…
-
High 8.6
A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware…
-
High 7.5
A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to…
-
High 7.8
Improper Signature Verification of Firmware Update Files
A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license files.It is necessary to use only the MyStormshield servers to retrieve update files or licenses, or to use automatic verification via SNS.
-
High 7.3
Ghostscript: reintroduction of .charkeys -dsafer bypass in rhel 8
A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected.…
-
High 8.8
YS-infoware｜BA-Workflow - SQL Injection
BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.
-
High 8.8
YS-infoware｜BA-Workflow - SQL Injection
BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.
-
High 8.8
YS-infoware｜BA-Workflow - SQL Injection
BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.
-
High 8.8
Uniong｜WebITR - Insecure Deserialization
WebITR developed by Uniong has a Insecure Deserialization vulnerability. Authenticated remote attackers can use the hard-coded cryptographic key to craft and submit malicious serialized data, thereby executing arbitrary code on the server.
-
High 7.5CVE-2026-93300 Public exploit
EventON - Subscriber <= 1.4.5 - Unauthenticated SQL Injection via 'email' Parameter
The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the ex…
-
High 7.2
Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A us…
-
High 7.1CVE-2026-113386 Public exploit
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated a…
-
High 8.8
Apache Airflow Amazon provider: AWS auth manager: SAML login CSRF logs users into the attacker's account
Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it. The login handler discards the AuthnRequest ID and the callback validates the assertion without requiring a matching…
-
High 8.2
Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corru…
-
High 8.5
An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code wi…
-
High 8.7
Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments
Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstream_request_filter and wrote it to the upstream without removing the client's Connection header, other hop-by-hop headers, or the headers Connec…
-
High 7.5
An authorization issue was addressed with improved network restrictions. This issue is fixed in iOS 27 and iPadOS 27. A…
-
High 7.8
A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Ga…
-
High 8.8
This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. A m…
-
High 7.8
This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. An …
-
High 8.8
A type confusion issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadO…
-
High 8.8
A stack overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 …
-
High 8.8
A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macO…
-
High 7.5
The issue was addressed with additional app bundle integrity checks. This issue is fixed in macOS Golden Gate 27. A mal…
-
High 7.8
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app may b…