97,140 results · Clear filters · Feed
-
High 7.5
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow a remote unauthenticated attacker to cause a denial of service due to uncontrolled resource consumption.
-
High 8.3CVE-2026-109519 Public exploit
YouTransfer Template Rendering template path traversal
A vulnerability was detected in YouTransfer up to 0.0.7/1.0.6/1.1.0. Affected is an unknown function of the file /settings/template of the component Template Rendering. The manipulation results in path traversal. The attack may be launched remotely. The explo…
-
High 7.1
Wazuh 3.12.0 before 4.14.8 Heap Buffer Overflow in wazuh-analysisd FIM Decoder
Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from input but written bounded by OS_MAXSTR. An enrolled agent can send a crafted FIM syscheck event to corrupt manager heap memory and determinist…
-
High 7.2
Wazuh 4.14.3 < 4.14.8 / 4.10.4 Remote Command Validation Bypass via Case Mismatch
Wazuh 4.14.3 before 4.14.8 and 4.10.4 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with manager:update_config can inject an uppercase LOG_FORMAT comma…
-
High 7.2
Wazuh 4.3.0 before 4.14.8 Remote Code Execution via SCA Command Policies
Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust is determined by file path rather than configuration source. Attackers controlling a manager can write unsigned policy files to var/incoming via the upgrade c…
-
High 7.2
Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_token
Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token never consults the blacklist. Attackers with revoked administrator grants can continue authenticating and self-link the administrator role…
-
High 7.2
Wazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_user
Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.update_user places the reserved user guard and password policy inside a falsy truthiness check. A delegated user administrator can send an empty password to …
-
High 7.5CVE-2026-74034 Public exploit
Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command
Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_path. Attackers can inject an upgrade_custom message over the agent channel to read a…
-
High 8.5
Froxlor 0.10.0 before 2.3.14 Newline Injection via Ftps.add additional_members
Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that allows authenticated customers to inject arbitrary entries into the root-owned NSS group database via the unvalidated additional_members parameter of the Ftps.add API. Attackers can …
-
High 7.7
Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Value
Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme value via customer_index.php. Script executes when an administrator views the custo…
-
High 7.0
NLTK through 3.10.3 Path Traversal via WekaClassifier Model Path
NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths. Attackers controlling the model_filename or model argument can make the weka JVM write…
-
High 8.8
FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect
FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an invalid connect operation. Attackers can trigger an invalid smartcard connect operati…
-
High 7.8
NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a us…
-
High 7.1
NVIDIA Megatron-LM for all platforms contains a vulnerability in inference, where an attacker could cause hash collisio…
-
High 7.8
NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where, an attacker could cause an RCE by convincing a…
-
High 8.6
NVIDIA AIStore for Linux and Kubernetes contains a missing authorization vulnerability in the ETL management API where …
-
High 8.1
NVIDIA AIStore for Linux contains a path traversal vulnerability in the dSort archive extraction component where a remo…
-
High 8.6
NVIDIA AIStore for Linux contains a vulnerability in the distributed sort component where an attacker could cause serve…
-
High 8.6
NVIDIA AIStore for Linux contains a vulnerability in the experimental HT backend where an unauthenticated remote attack…
-
High 7.5
NVIDIA AIStore for Linux contains a vulnerability in the Promote API where an unauthenticated remote attacker may read …
-
High 8.1
NVIDIA AIStore for Linux contains a path traversal vulnerability in the target-side object rename handler, where an una…
-
High 7.3
NVIDIA DALI contains a vulnerability where an attacker could cause a stack-based buffer overflow. A successful exploit …
-
High 7.3
NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read. A successful exp…
-
High 7.3
NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds write. A successful ex…
-
High 7.3
NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read. A successful exp…
-
High 7.8
NVIDIA Isaac Lab contains a vulnerability where an attacker could cause an eval injection. A successful exploit of this…
-
High 7.3
conductor-oss conductor KafkaPublishTask.java KafkaPublishTask.start server-side request forgery
A security flaw has been discovered in conductor-oss conductor up to 3.33.0-rc10. This affects the function KafkaPublishTask.start of the file kafka/src/main/java/com/netflix/conductor/contribs/tasks/kafka/KafkaPublishTask.java. The manipulation of the argume…
-
High 8.3
Mitigation bypass in the File Handling component
Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5 and Thunderbird 153.5.
-
High 8.3
Mitigation bypass in the File Handling component
Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5 and Thunderbird 153.5.
-
High 8.8
Privilege escalation in the WebExtensions component
Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
-
High 8.1
Mitigation bypass in the Enterprise Policies component
Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
-
High 8.8
Incorrect boundary conditions in the SVG component
Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
-
High 8.1
Mitigation bypass in the Networking: HTTP component
Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
-
High 8.3
Sandbox escape due to race condition in the Networking component
Sandbox escape due to race condition in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
-
High 8.8
Privilege escalation in the DOM: Navigation component
Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
-
High 8.1
Site isolation issue in the Networking component
Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
-
High 8.1
Incorrect boundary conditions in the DOM: Editor component
Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
-
High 7.3
Mitigation bypass in the DOM: Security component
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
-
High 8.1
Other issue in the DOM: File component
Other issue in the DOM: File component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
-
High 7.3
Other issue in the Address Bar component
Other issue in the Address Bar component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.