96,977 results · Clear filters · Feed
-
High 7.0
Akaunting 3.3.0 - Stored XSS through imported item names
Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in the XLSX item-import workflow. An authenticated Manager can import an item whose name contains HTML. When another authenticated user selects that item while creating a document, Akaunting…
-
High 7.4
pam_usb: deny_remote bypassed by compressed IPv6 addresses in pusb_tmux_has_remote_clients
pam_usb provides hardware authentication for Linux using removable media. From version 0.8.0 to before version 0.9.3, the deny_remote feature in pam_usb uses /usr/bin/w -i to detect whether the authenticating user has an active remote tmux session. In pusb_tm…
-
High 7.1
pam_usb: getenv() in pusb_local_login bypasses XRDP deny via env-var unset
pam_usb provides hardware authentication for Linux using removable media. Prior to version 0.9.3, src/local.c reads XRDP_SESSION with plain getenv(3) at the head of pusb_local_login while every other env consumer in the same function uses secure_getenv(3). Wh…
-
High 7.4
pam_usb: deny_remote bypassed by zone-indexed IPv6 addresses (fe80::1%eth0) in pusb_tmux_has_remote_clients
pam_usb provides hardware authentication for Linux using removable media. From version 0.8.0 to before version 0.9.3, the deny_remote feature in pam_usb uses /usr/bin/w -i to detect whether the authenticating user has an active remote tmux session. In pusb_tm…
-
High 7.2
Stored XSS in the @waline/client UserList widget via an unescaped commenter link field
Waline is a comment system with backend support. In versions 3.15.2 and prior, the @waline/client UserList widget builds its DOM by concatenating server-returned commenter fields directly into root.innerHTML with no HTML escaping. The commenter nick and link …
-
High 7.1
LimeSurvey Community Edition 7.8.0 - SQL injection via Archive Attributes
LimeSurvey Community Edition 7.8.0 contains an SQL injection vulnerability in the survey-archive participant import and SPSS-response export workflow. An authenticated user with global surveys.create permission can import a crafted .lsa archive whose particip…
-
High 8.1
node-fontnik: integer-overflow heap out-of-bounds write in RenderSDF
node-fontnik is a library that delivers a range of glyphs rendered as SDFs (signed distance fields) in a protocol buffer. Prior to version 0.7.7, a crafted font could trigger a heap out-of-bounds write in RenderSDF (include/mapbox/glyph_foundry_impl.hpp). Ren…
-
High 7.6
Padloc 4.0.0 before 4.3.1 Prototype Pollution via SCIM PATCH setPath()
Padloc 4.0.0 before 4.3.1 contains a prototype pollution vulnerability that allows SCIM token holders to modify Object.prototype by sending crafted SCIM PATCH paths to ScimServer._handleScimUsersPatch(). Attackers can supply paths like __proto__.x or construc…
-
High 7.1
Semantic MediaWiki 7.3.1 before 7.4.1 contains an incorrect authorization vulnerability in EditProtectionUpdater::userM…
-
High 7.1
Semantic MediaWiki 2.5.0 before 7.4.1 Missing Authorization via Is edit protected Annotation
Semantic MediaWiki 2.5.0 before 7.4.1 contains a missing authorization vulnerability that allows editors without the edit-protection right to lock pages by adding an Is edit protected annotation. Attackers can add [[Is edit protected::true]] to pages or #set …
-
High 8.7
Bahmni-Core: Path traversal may lead to arbitrary file write in the admin CSV import
OpenMRS module bahmnicore contains Core OpenMRS modules for Bahmni (including ERP & ELIS Atom Feed Clients). In version 0.93, there is insufficient validation of input paths during the admin CSV import process, allowing for potential arbitrary file write. Thi…
-
High 7.1
OpenMRS module bahmnicore contains Core OpenMRS modules for Bahmni (including ERP & ELIS Atom Feed Clients). In version…
-
High 7.5
WWBN AVideo through 29.7.1 Wallet Credit Manipulation via PayPalYPT ipnV2.php
WWBN AVideo through 29.7.1 contains an improper payment verification vulnerability in plugin/PayPalYPT/ipnV2.php that credits wallets from PayPal IPNs not bound to the site's merchant account. Unauthenticated attackers can forward genuine VERIFIED recurring-p…
-
High 8.1
WWBN AVideo through 29.7.1 Missing Authorization via Live Restream Endpoints
WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in Live plugin restream endpoints that allows authenticated streamers to obtain other users' stream keys by supplying arbitrary live_transmitions_history_id values. Attackers can redeem…
-
High 8.1
Directus before 12.1.0 Authorization Bypass via Public WebSocket REST Interface
Directus before 12.1.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to skip permission checks by sending a failed auth message on public-mode WebSocket connections. Attackers can send an invalid token so handleAuthReque…
-
High 7.4
Jellyfin before 12.0 Path Traversal via Library VirtualFolders Endpoints
Jellyfin before 12.0 contains a path traversal vulnerability in the DELETE /Library/VirtualFolders and POST /Library/VirtualFolders/Name endpoints that allows attackers to delete or move directories via unvalidated library names. Unauthenticated attackers can…
-
High 7.8CVE-2026-126497 Public exploit
LibreCAD through 2.2.1.6 Heap Out-of-Bounds Write via dwgReader18::parseDataPage
LibreCAD through 2.2.1.6 contains a heap-based out-of-bounds write vulnerability in the bundled libdxfrw dwgReader18::parseDataPage() function due to unchecked buffer size and page offsets. Attackers can craft an AC1018 (R2004) DWG file with malicious startOf…
-
High 8.4
Insufficient verification of data authenticity may allow a local attacker to bypass Secure Debug Unlock (SDU), potentia…
-
High 7.8
The simulated EEPROM driver validated access ranges in eeprom_range_is_valid() (drivers/eeprom/eeprom_simulator.c) with…
-
High 8.3
The RFCOMM multiplexer control-channel handler in subsys/bluetooth/host/classic/rfcomm.c computed the echo length for a…
-
High 8.8
U.S. Geological Survey Area Species Management Research Program unrestricted file upload
U.S. Geological Survey Area Species Management Research Program (ARMI) accepts any uploaded file and stores the file under '/uploads/{upload-file}'. A remote, authenticated attacker could upload a crafted PHP file that executes and returns command output from…
-
High 8.2
The request-callout plugin in Kong Gateway Enterprise and Kong AI Gateway omits callout headers not sent by the client …
-
High 7.8
Kong Gateway Enterprise and Kong AI Gateway include decoded CR/LF characters from the request path in the X-Forwarded-P…
-
High 7.8
The SAML plugin in Kong Gateway Enterprise does not enforce AudienceRestriction, allowing a valid assertion issued for …
-
High 8.2
The ai-azure-content-safety plugin in Kong Gateway Enterprise skips inspection of request bodies larger than the in-mem…
-
High 8.2
The caching plugins in Kong Gateway Enterprise and Kong AI Gateway may serve a response cached for a request carrying a…
-
High 8.8
Adobe Connect | Incorrect Authorization (CWE-863)
Adobe Connect is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to sensitive information or functionality. Exploitation of this…
-
High 7.7
Adobe Connect | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead to disclosure of sensitive memory. A low-privileged attacker could leverage this vulnerability to disclose sensi…
-
High 8.3
Adobe Connect | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this v…
-
High 7.7
Adobe Connect is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could …
-
High 8.7
Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they brow…
-
High 8.3
The graphql-proxy-cache-advanced plugin in Kong Gateway Enterprise omits the caller's identity from the cache key, allo…
-
High 8.3
Improper neutralization of HTTP headers for scripting syntax vulnerability in N-able N-central allows Cross-Site Script…
-
High 8.6
Relative path traversal vulnerability in N-able N-central allows Path Traversal. This issue affects N-central: before 2…
-
High 8.2
Dimension | Improper Input Validation (CWE-20)
Dimension is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this is…
-
High 8.7
The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway omit the request hostna…
-
High 8.6
Local privilege escalation to root via nable-writable syslog-ng config
Incorrect privilege assignment vulnerability in N-able N-central allows Privilege Escalation. This issue affects N-central: before 26.4.1.
-
High 8.7
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in N-able N-central …
-
High 7.5
Root RCE via unsigned NSP upgrade package upload
Download of code without integrity check vulnerability in N-able N-central allows Remote Code Inclusion. This issue affects N-central: through 24.6.1.
-
High 7.4
Action Pack: Possible IP spoofing in Action Dispatch RemoteIp
Action Pack is a framework for handling and responding to web requests. From 8.1 until 8.1.4.1, Since Rails 8.1.0, ActionDispatch::RemoteIp derives request.remote_ip from Rack::Request#forwarded_for, which under Rack 3 reads the RFC 7239 Forwarded header in p…