97,168 results · Clear filters · Feed
-
High 7.6
Docker Engine insecure-registry fallback via malicious DNS responses
Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries() injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default. isCIDRMatch resolves all of the hostname's addresses and returns true if a single add…
-
High 7.7
Backstage: Improper input validation in TechDocs Markdown extension configuration
Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package did not sufficiently validate TechDocs Markdown extension configuration. An authenticated user who can register or modify do…
-
High 8.8
Cisco Meraki Security Hardening Release October 2026 - Improper Neutralization of Special Elements Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally…
-
High 7.5
Cisco Meraki Software Hardening Release - Resource Lifetime Management Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple interna…
-
High 8.8
Cisco Meraki Hardening Release - Incorrect Calculation Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple interna…
-
High 7.4
Cisco Meraki Security Hardening Release: October 2026 Insufficient Control Flow Management Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internal…
-
High 8.2
Cisco Meraki Hardening Release - Input Validation Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple interna…
-
High 8.8
Cisco Meraki Security Hardening Release: October 2026 - Improper Access Control Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple interna…
-
High 8.8
Cisco License On-Prem Security Hardening Release
As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review r…
-
High 8.6
Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Handling of Exceptional Conditions Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally d…
-
High 8.6
Cisco NX-OS Software Security Hardening Release: October 2026 - Out-of-bounds Read Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally d…
-
High 8.6
Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Input Validation Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally d…
-
High 8.8
Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Neutralization Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally d…
-
High 7.2
Cisco Finesse Server-Side Request Forgery Vulnerability
A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability is due to improper input validation for…
-
High 8.1
Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query
Homer is open source telecom observability software. Prior to version 11.0.283, the `V4StatisticsQuery` handler passes the user-supplied `rawquery` field directly to DuckDB without calling the `sqlvalidator.ValidateRawSQL` function used throughout the rest of…
-
High 7.1
Gophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create Endpoints
Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups, templates, landing pages and sending profiles. Attackers can supply another user's sequential id in POST reques…
-
High 7.2
LMCache through 0.5.5 Missing Authentication in Frontend Node Catalog Allows SSRF Allowlist Bypass
LMCache through 0.5.5 contains a server-side request forgery vulnerability in its frontend monitoring service that allows unauthenticated attackers to bypass the proxy allowlist by registering arbitrary hosts. Attackers can add entries via POST /api/proxies a…
-
High 8.6
LMCache through 0.5.5 Missing Authentication in MP Coordinator Fleet Control API
LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers to access its HTTP fleet control API listening on all interfaces by default. Attackers can register or deregiste…
-
High 7.1
Backstage: Improper repository path validation in a Scaffolder backend module
Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package is affected by improper repository path validation in a scaffolder backend module. An authenticated …
-
High 8.8
Backstage: Improper validation of TechDocs MkDocs configuration
Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdown_extensions configuration. An authenticated attacker who can register or …
-
High 7.7
Backstage: Configuration bypass in TechDocs mkdocs.yml sanitization
Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by configuration bypass in techdocs mkdocs.yml sanitization. Insufficient validation of MkDocs configuration during TechDoc…
-
High 7.7
Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml
Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdown_extensions in techdocs mkdocs.yml. An authenticated user who can register cat…
-
High 8.2
libexpat Heap Buffer Over-read in xmlparse.c via XML_ParseBuffer
libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, …
-
High 7.1
wger: Trainer Privilege Escalation - Improper Privilege Management
wger is a free, open-source workout and fitness manager. Prior to version 2.6, a user with only the `gym_trainer` permission can deactivate any account in the same gym, including `gym_manager` and `general_gym_manager` accounts. The `UserDeactivateView` grant…
-
High 8.1
llama.cpp before b11393 Use-After-Free via common_chat_peg_mapper chat_parser
llama.cpp before b11393 contains a use-after-free and double free vulnerability in common_chat_peg_mapper::map that allows unauthenticated remote attackers to corrupt heap memory via a dangling current_tool pointer. Attackers can submit a chat_parser in a POS…
-
High 8.1CVE-2026-107181 Public exploit
Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme
Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme han…
-
High 7.1
wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)
wger is a free, open-source workout and fitness manager. Prior to version 2.6, five gym management views in wger apply a flawed gym-scope guard (`gym_a != gym_b`) that silently passes when both operands are `None`. A trainer with `gym.gym_trainer` and `gym.ad…
-
High 7.2CVE-2026-102257 Public exploit
A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extra…
-
High 7.8CVE-2026-102256 Public exploit
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerab…
-
High 8.8
tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()
In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() When tcp_send_synack() replaces the cloned SYN skb at the head of the retransmit queue with a copy, it frees the original w…
-
High 7.7
Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code
Claude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at write time without repeating that validation. This time-of-check to time-of-use (TOCTOU) gap allowed an attacker w…
-
High 7.1
MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances
On MISP instances configured to require TOTP enrolment (Security.otp_required), the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the…
-
High 8.8
GitAhead through 2.7.1 on macOS Command Injection via Show in Finder AppleScript
GitAhead through 2.7.1 on macOS contains a command injection vulnerability that allows attackers to execute shell commands by crafting repository filenames interpolated unescaped into the Show in Finder AppleScript. Attackers can commit a file whose path cont…
-
High 7.8
patool before 4.0.6 OS Command Injection on Windows via shell_quote_nt
patool before 4.0.6 contains an OS command injection vulnerability on Windows because shell_quote_nt fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-f…
-
High 7.5
GitAhead through 2.7.1 OS Command Injection via Git Filter Filenames
GitAhead through 2.7.1 contains an OS command injection vulnerability in src/git/Filter.cpp that allows malicious repositories to execute commands by substituting crafted filenames into clean/smudge filter commands. Attackers can ship files named with $(comma…
-
High 7.5
Rundeck before 6.2.0 OS Command Injection via Windows Job Option Quoting
Rundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permission to execute commands on Windows nodes by supplying crafted option values. Attackers can inject cmd.exe metacharacters such as && or | in…
-
High 7.6
WordPress WP Post Author plugin <= 4.0.0 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AF themes WP Post Author wp-post-author allows Blind SQL Injection.This issue affects WP Post Author: from n/a through 4.0.0.
-
High 7.6
WordPress Slider by 10Web plugin <= 1.2.63 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 10Web Slider by 10Web slider-wd allows Blind SQL Injection.This issue affects Slider by 10Web: from n/a through 1.2.63.
-
High 7.6
WordPress Post title marquee scroll plugin <= 9.9 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Gopiplus Post title marquee scroll post-title-marquee-scroll allows Blind SQL Injection.This issue affects Post title marquee scroll: from n/a through 9.9.
-
High 7.6
WordPress Pix por Piggly (para Woocommerce) plugin <= 2.1.2 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Piggly Dev Pix por Piggly (para Woocommerce) pix-por-piggly allows Blind SQL Injection.This issue affects Pix por Piggly (para Woocommerce): from n/a through…