97,113 results · Clear filters · Feed
-
High 7.2
Ettercap through 0.8.4.1 contains an out-of-bounds read vulnerability in Parse_NTLM_Auth() in src/dissectors/ec_http.c …
-
High 7.5
Ettercap through 0.8.4.1 Stack Buffer Overflow via WPA CCMP Decryption
Ettercap through 0.8.4.1 contains an integer underflow in ccmp_decrypt() in src/ec_encryption_ccmp.c that subtracts the 8-byte CCMP trailer without checking minimum length. Attackers on a network whose WPA key is loaded can send a short crafted CCMP frame to …
-
High 8.1
Ettercap through 0.8.4.1 Heap Out-of-Bounds Read via TLS SNI Parsing
Ettercap through 0.8.4.1 contains a heap out-of-bounds read vulnerability in sslw_get_clienthello_sni() in src/ec_sslwrap.c that trusts the unchecked 16-bit SNI length field. Network-adjacent attackers can send crafted TLS ClientHello messages during SSL inte…
-
High 8.1
Ettercap through 0.8.4.1 Out-of-Bounds Read via sslw_remove_sts
Ettercap through 0.8.4.1 contains an out-of-bounds read and size_t underflow vulnerability in sslw_remove_sts() in src/ec_sslwrap.c, caused by a stale length and an unchecked memmem() result when stripping Strict-Transport-Security headers. A malicious HTTPS …
-
High 7.2
Ettercap through 0.8.4.1 contains a heap buffer overflow vulnerability in gg_get_version() in src/dissectors/ec_gg.c th…
-
High 8.0CVE-2026-125399 Public exploit
Fluxion before 6.39 OS Command Injection via Crafted SSID
Fluxion before 6.39 contains an OS command injection vulnerability in the fluxion.sh target scanner, which decodes access point ESSIDs with eval after escaping only single quotes. Attackers within Wi-Fi range can broadcast an access point with a crafted SSID …
-
High 8.8
Ettercap through 0.8.4.1 Use-After-Free via PCRE2 Filter Substitution
Ettercap through 0.8.4.1 contains a use-after-free vulnerability in func_pcre() in src/ec_filter.c that reads the PCRE2 ovector after freeing match data. Network-adjacent attackers can send packets matching a loaded pcre_regex() substitution filter to corrupt…
-
High 7.1
Instatic before 0.0.21 Authorization Bypass via Row Author Reassignment Endpoint
Instatic before 0.0.21 contains an authorization bypass vulnerability in handleRowAuthor that allows authenticated users to skip table-level access checks by loading rows with getDataRow() instead of loadRowForAccess(). Attackers holding content.edit.any but …
-
High 7.8
Ghostscript before 10.08.0 -dSAFER Bypass via .putgstringcopy .forceput Recovery
Ghostscript before 10.08.0 contains a -dSAFER bypass vulnerability in the .putgstringcopy procedure in gs_fonts.ps, which calls the privileged .forceput operator without checking operand types. Attackers can supply crafted PostScript or PDF documents that tri…
-
High 7.1
NocoBase plugin-ai 2.1.0 through 2.2.41 contains an authorization bypass vulnerability in getAccessibleAIEmployee() tha…
-
High 7.1
MailEnable Enterprise Premium before 10.62 contains a heap overflow vulnerability in the IMAP X-FB-FETCH command that a…
-
High 7.2
Webmin through 2.670 OS Command Injection via Samba User Account Options
Webmin through 2.670 contains an OS command injection vulnerability in samba/save_euser.cgi that allows authenticated Samba user maintainers to inject commands via unvalidated opts parameter. Attackers can embed shell metacharacters in account option flags pa…
-
High 7.1
INDOTALENT WHMS before 10.20261109 contains a path traversal vulnerability that allows authenticated users to read arbi…
-
High 7.2
Map-OS 5.0.0 to before 5.2.2 Privilege Escalation via /api/v1/usuarios
Map-OS 5.0.0 to before 5.2.2 contains a privilege escalation vulnerability in the REST users API that allows non-administrator operators holding the cUsuario permission to bypass permission-delegation and super-administrator protections. Attackers can send PO…
-
High 7.1
Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users …
-
High 7.5
OmniAgent Bash Approval Gate Bypass via find -execdir in Safe-Command Allowlist
OmniAgent through commit 12b98c5 contains an approval bypass vulnerability in ReflexionAgent._is_safe_bash_command that treats any command starting with find as safe without inspecting -execdir arguments. Prompt-injected agents can run find with -execdir to i…
-
High 8.1
frab through 0.9.1 Privilege Escalation via conference_users_attributes in UsersController
frab through 0.9.1 contains a privilege escalation vulnerability that allows authenticated crew users to grant themselves orga roles by submitting unchecked nested conference_users_attributes. Attackers can abuse UsersController#update or #create, which skip …
-
High 7.1
DollarDollar through 4.4 contains a missing authorization vulnerability in add_expense() that allows authenticated user…
-
High 7.2
Storyden through 1.26.16 Privilege Escalation via MANAGE_ROLES Role Assignment
Storyden through 1.26.16 contains a privilege escalation vulnerability that allows users holding MANAGE_ROLES to grant the ADMINISTRATOR permission without being administrators. Attackers can call AccountAddRole on another controlled account or use RoleCreate…
-
High 7.2
Tencent BrowserSkill through 0.4.2 contains a missing authentication vulnerability that allows local attackers to imper…
-
High 8.1
Universal-modder before e88f687 Cross-Site WebSocket Command Execution via HostLink
Universal-modder before commit e88f6876745427321eb755ebc98276063a962d8a contains a missing WebSocket Origin validation vulnerability in the HostLink class of its passthrough example mods that allows remote attackers to execute Minecraft commands. Any web page…
-
High 7.3
SourceCodester Smart Attendance System with QR Code Scanner Admin Account Creation create_admin.php getMessage missing authentication
A vulnerability has been found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This impacts the function getMessage of the file create_admin.php of the component Admin Account Creation. Such manipulation of the argument e leads to missing …
-
High 7.3
SourceCodester Smart Attendance System with QR Code Scanner Password Reset reset_password.php password recovery
A flaw has been found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown function of the file reset_password.php of the component Password Reset. This manipulation of the argument username/password causes weak password…
-
High 7.5
Mongoose: Connection-level sanitizeFilter not applied
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. From 6.0.0 until 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose stores the connection-level sanitizeFilter option in Connection.config, but Query.prototype._castConditi…
-
High 7.1
Unsafe reflection in Amazon Braket Schemas error mitigation validation
Unsafe reflection in the error mitigation schema validation in Amazon Braket Schemas before 1.32.2 might allow a remote authenticated user with S3 write access to the quantum task output location to execute arbitrary code on any machine that retrieves the qua…
-
High 8.2
Mongoose walks into inherited properties when hydrating, setting, and merging, allowing overwrites of built-in functions (denial of service) and shared schema state
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose can descend into inherited properties while loading database documents in init(), setting dotted paths in $__set…
-
High 8.3
Novu provides an API for sending notifications through multiple channels. Prior to 3.15.0, the conditions filter webhoo…
-
High 7.5
NXP ENET-QOS Ethernet driver re-arms RX descriptors with a clobbered DMA buffer address on packet drop
The NXP ENET-QOS Ethernet driver's receive work handler eth_nxp_enet_qos_rx() in drivers/ethernet/eth_nxp_enet_qos hands each processed descriptor back to the DMA by writing desc->read.control = rx_desc_refresh_flags, which sets OWN_FLAG and BUF1_ADDR_VALID_F…
-
High 7.8
Xtensa MMU userspace: uninitialized thread page-table pointer leads to out-of-bounds supervisor-mode writes
The Xtensa MMU userspace port never initialized the per-thread page-table pointer thread->arch.ptables during thread setup, while arch_mem_domain_thread_add() in arch/xtensa/core/ptables.c uses a non-NULL value of that field as its "this thread is migrating f…
-
High 7.5
Rack: Multipart parsing allows DoS via unbounded scan buffer growth
Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser can retain parsed data in its internal StringScanner buffer when reads end inside or immediately after multipart headers. An unauthenticated attacker can …
-
High 7.0
zizmor: Debug logging prints available GitHub credentials in cleartext
zizmor is a static analysis tool for CI/CD systems. In version 1.27.0, debug logging serializes the parsed application configuration with a derived Debug implementation for GitHubToken, causing credentials supplied through GH_TOKEN, GITHUB_TOKEN, ZIZMOR_GITHU…
-
High 8.8
AsyncSSH: SFTPServer Chroot Escape
AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, SFTPServer.map_path() uses posixpath.normpath() on a client-supplied path and removes o…
-
High 7.5
ModSecurity v3 XML Request Body Processor Uninitialized Pointer Dereference Vulnerability
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.15 until 3.0.17, XML request body processing with SecParseXmlIntoArgs set to On or OnlyArgs can leave XMLNodes::parsing_ctx_arg uninitializ…
-
High 7.8
Local privilege escalation via untrusted OpenSSL configuration
The OpenSSL library bundled with the Illumio VEN for Windows is affected by an uncontrolled search path vulnerability. A low-privileged, authenticated local attacker could potentially leverage this vulnerability to execute arbitrary code with SYSTEM privilege…
-
High 7.8
Local privilege escalation via insecure folder permissions
Incorrect permission assignment allows local privilege escalation to SYSTEM on affected releases of the Illumio VEN for Windows. Code execution as NT AUTHORITY\LOCAL SERVICE on the Windows host is required to exploit this vulnerability. The flaw exists within…
-
High 7.5
Muhammara: NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key
Muhammara is a node module with c/cpp bindings to modify PDF with JavaScript for node or electron. Prior to 6.0.5, Muhammara PDFParser::CreateFilterForStream() in src/deps/PDFWriter/PDFParser.cpp dereferences a null PDFInteger pointer when a PDF stream uses t…
-
High 7.5
bird-lg-go is a BIRD looking glass in Go. Prior to version 1.4.7, unsanitized input path enables arbitrary local file r…
-
High 7.5
LMDeploy URL parser disagreement permits SSRF filter bypass
LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0, _is_safe_url validates remote media URLs with urlparse while requests.Session().get interprets backslashes differently when sending the request. An …
-
High 8.7
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the WebSocket reader r…
-
High 7.5
Monoceros versions before 0.30 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory
Monoceros versions before 0.30 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory. The request body is read in a loop that asks sysread for all of the remaining declared length at once. Perl grows the read buffer t…