97,132 results · Clear filters · Feed
-
High 7.3
agentscope-ai AgentScope MCP Workspace API _config.py subprocess.Popen os command injection
A vulnerability was detected in agentscope-ai AgentScope up to 2.0.11. The impacted element is the function subprocess.Popen of the file src/agentscope/mcp/_config.py of the component MCP Workspace API. The manipulation of the argument command results in os c…
-
High 7.5
SQL Injection in Kobikom Telecommunications' Kobikom
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Kobikom Telecommunications and Informatics Services Inc. Kobikom allows SQL Injection. This issue affects Kobikom: before KobiPBX-FOP3-SEC-r1.
-
High 7.5
Keycloak admin client secret stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts
In Eclipse BaSyx Helm Charts version 2.2.0 of the `aas-basyx-v2-full` chart, deployments with the bundled Keycloak enabled store the client secret of the `basyx-technical-user` OAuth2 client in cleartext in a Kubernetes ConfigMap. This client uses the client-…
-
High 7.5
Path Traversal in Kobikom Telecommunications' Kobikom
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Kobikom Telecommunications and Informatics Services Inc. Kobikom allows Path Traversal. This issue affects Kobikom: before KobiPBX-FOP3-SEC-r1.
-
High 7.5
Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling
Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling Engine. The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors. This i…
-
High 7.5
Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization
Improper output neutralization for logs in Apache Sling Engine. This issue affects Apache Sling Engine: before 3.0.4. Users are recommended to upgrade to version 3.0.4, which fixes the issue.
-
High 7.5
Keycloak admin user password stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts
In Eclipse BaSyx Helm Charts versions 3.0.0-rc.1 to 3.12.1 of the `basyx` chart, deployments with the bundled Keycloak enabled store the passwords of the Keycloak users that the chart creates in cleartext in a Kubernetes ConfigMap. The template `keycloak-init…
-
High 7.3
eosphoros-ai DB-GPT HuggingFace Adapter hf_adapter.py exec_module inclusion of functionality from untrusted control sphere
A weakness has been identified in eosphoros-ai DB-GPT up to 0.8.2. Impacted is the function exec_module of the file hf_adapter.py of the component HuggingFace Adapter. Executing a manipulation of the argument trust_remote_code can lead to inclusion of functio…
-
High 8.7
Apache Juneau: Denial of service via unbounded memory allocation in parsers and REST request handling
Allocation of Resources Without Limits or Throttling vulnerability in Apache Juneau. The MessagePack parser, which the REST server enables by default, sizes buffers from length values in the input. An unauthenticated client can send a few bytes that force a m…
-
High 8.3
eosphoros-ai DB-GPT CodeAction code_utils.py execute_code code injection
A security flaw has been discovered in eosphoros-ai DB-GPT up to 0.8.2. This issue affects the function execute_code of the file code_utils.py of the component CodeAction. Performing a manipulation results in code injection. The attack can be initiated remote…
-
High 8.8
An OS command injection vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitra…
-
High 7.4
vault-java-driver: SslConfig silently disables requested TLS verification
vault-java-driver, a Java client for HashiCorp Vault, silently disables TLS certificate and hostname verification in three states where the caller asked for verification: an SslConfig passed to VaultConfig without calling build(), an SslConfig restored by Jav…
-
High 8.3
Authentication bypass in the HA heartbeat origin check in middlewared in TrueNAS SCALE before 25.10.8 (and in release t…
-
High 7.5
Wowza Streaming Engine before 4.12.2 processes XML external entities, which allows remote attackers to read local files…
-
High 7.1
WP PageNavi Style <= 1.4 - Stored XSS via CSRF
The WP PageNavi Style WordPress plugin through 1.4 does not sanitise and escape some of its settings, and has no CSRF check when they are saved, which could allow attackers to make a logged-in administrator store arbitrary JavaScript via a CSRF attack that is…
-
High 8.8
Cloud Blocks <= 1.1.8 - Unauthenticated Stored XSS
The Cloud Blocks WordPress plugin through 1.1.8 does not perform any authorisation or sanitisation when storing block asset URLs, allowing unauthenticated users to store malicious scripts that are executed in the browser of any privileged user, such as an adm…
-
High 8.2
WP Event Manager 3.4.0 - 3.4.1 - Unauthenticated Unpublished Post Overwrite via IDOR
The WP Event Manager WordPress plugin before 3.4.2 does not verify the ownership or the post type of a user supplied post identifier in its front-end event submission flow, allowing unauthenticated attackers to read and overwrite the content of arbitrary unpu…
-
High 8.1
WP Event Manager < 3.4.2 - Subscriber+ Arbitrary Post Takeover via event_organizer_ids
The WP Event Manager WordPress plugin before 3.4.2 does not properly validate ownership or the type of the user-supplied post identifiers processed by one of its frontend forms, allowing any user with a Subscriber account or above to reassign the authorship o…
-
High 8.7CVE-2026-123014 Public exploit
iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler, allowing an attacker t…
-
High 7.1
In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read acce…
-
High 8.8
GiveWP <= 4.19.1 - Authenticated (Custom+) Privilege Escalation to 'donor_default_user_role' Parameter
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.19.1 via the `donor_default_user_role` parameter. This is due to the `sanitize_option_donor_default_user_r…
-
High 8.2
LiteSpeed Cache <= 7.9.1 - Unauthenticated Sensitive Information Disclosure (WooCommerce Store API Cart/Checkout PII + Cart-Token) via Public REST Caching
The LiteSpeed Cache plugin for WordPress is vulnerable to unauthenticated disclosure of sensitive WooCommerce customer data in all versions up to, and including, 7.9.1 With Cache REST enabled (the shipped default cache-rest=1), LiteSpeed stores WooCommerce St…
-
High 8.1
Motors <= 1.4.128 - Authenticated (Subscriber+) File Deletion via 'stm_dealer_logo_path' Parameter
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to File Deletion in all versions up to, and including, 1.4.128 The vulnerability exists because `stm_save_user_extra_fields()`, hooked to `personal_options_update`, wr…
-
High 7.2
@twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim. This affects an outbound HTTP request t…
-
High 7.5
In the baseband, memory corruption during NAS packet processing can cause a denial of service.
-
High 8.8
Out of bound access in PPC due to race condition in global variable access
-
High 7.3
A double free vulnerability in NPU driver due to improper pointer management (941)
-
High 8.1
In the Samsung Exynos NPU kernel driver, an integer overflow allows an unprivileged application to trigger memory corru…
-
High 7.3
Integer overflow in NPU driver parameter processing due to insufficient bounds checking.
-
High 7.5
In the Samsung Exynos NPU driver, improper validation of user input in the ioctl handler can lead to an out-of-bounds w…
-
High 7.5
In the Exynos NPU driver, improper validation of user input in the ioctl handler can lead to an out-of-bounds write, wh…
-
High 7.8
In the Samsung Exynos H-Arx DRM plugin, improper input validation during buffer operations can cause memory corruption,…
-
High 7.5
Incorrect authorization in Samsung framework services due to missing permission checks
-
High 8.4
Memory corruption in GPU driver due to improper validation of VMID reservation.
-
High 8.4
In the Samsung GPU driver, improper reference count handling during command submission can lead to memory corruption.
-
High 7.5
Incorrect handling of unauthenticated downlink RRC Setup messages can cause the baseband to crash
-
High 7.5
Improper handling of NAS DLTransport messages may lead to a baseband crash.
-
High 7.5
Incorrect handling of SDP payload leads to a Denial of Service
-
High 7.5
Processing a malformed RRC Reconfiguration message leads to an out-of-bounds (OOB) access, resulting in a denial-of-ser…
-
High 7.5
In the NAS Authentication Request message decoding procedure, a missing lower bound check causes an infinite loop, lead…