405,076 results · Feed
-
High 8.6
In Progress® Telerik® UI for ASP.NET Core versions `2015.1.318` through `2026.3.811`, repeated server-side aggregation …
-
Critical 9.9
A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-controlled na…
-
High 7.1
Cross-Site Scripting in Kendo UI for jQuery PropertyGrid Values and Descriptions
In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PropertyGrid does not encode bound property values and items[].description in its default configuration. An attacker who can influence either value can cause JavaScrip…
-
Unscored —
When parsing request variables such as query-string and form parameters, HHVM did not check that appending a nested arr…
-
Unscored —
When a remote, unauthenticated HTTP/1.1 client pipelined the start of a second request and then stopped reading, proxyg…
-
Unscored —
In proxygen's HTTP/3 session, when a HEADERS block referenced QPACK dynamic table entries that had not yet been receive…
-
Unscored —
An mvfst QUIC server retained CRYPTO frame data received at an encryption level (Initial or Handshake) that the TLS han…
-
Unscored —
proxygen's QPACK decoder enforced its size limit on a string literal in an encoder-stream instruction only after the en…
-
Unscored —
mvfst did not adequately merge or compact out-of-order STREAM frame data, and a small received fragment could keep a mu…
-
Unscored —
proxygen's HTTP/3 codec buffered an incomplete non-DATA frame, such as a control-stream frame, a frame of an unknown or…
-
High 7.1
Cross-Site Scripting in Kendo UI for jQuery PivotGrid Axis Chips
In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PivotGrid and PivotConfigurator axis field names are passed to a chip template without appropriate encoding. An attacker who can influence an axis field name can cause…
-
High 7.1
Cross-Site Scripting in Kendo UI for jQuery Grid and TreeList Column Reordering
In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, the Grid and TreeList column-reorder drag clue reparses header text as HTML. An attacker who can influence a column field or title used by an affected application can …
-
High 7.1
Cross-Site Scripting During Kendo UI for jQuery Custom SVG Icon Sanitization
In Progress Kendo UI for jQuery, sanitizeSvgContent() parses custom icon markup into a live DOM before filtering it. An attacker who can influence custom icon content can cause JavaScript to execute during icon creation, before an unsafe element is removed. T…
-
High 7.1
Cross-Site Scripting in Kendo UI for jQuery ActionSheet Header Labels
In Progress Kendo UI for jQuery versions 2026.3.1014 up to, but not including, 2026.4.1110, ActionSheet does not encode title, subtitle, and header button label values before rendering them. An attacker who can influence these values can inject markup that ex…
-
High 7.1
Cross-Site Scripting via the spriteCssClass Field in Kendo UI for jQuery
In Progress® Kendo® UI for jQuery prior to 2026.4.1111 the TabStrip, PanelBar, and Menu widgets support mapping a dataSource field to `spriteCssClass`. If an attacker can control the mapped data, they can break out of the attribute and inject markup, includin…
-
Unscored —
Rooxis RXR-12 Wi-Fi router contains an undocumented telnet backdoor daemon (/usr/bin/telnetd_startup) that, upon receip…
-
Unscored —
Rooxis RXR-12 Wi-Fi router contains an authenticated command injection vulnerability in the LuCI white_list RPC handler…
-
Unscored —
Rooxis RXR-12 Wi-Fi router contains an undocumented UID-0 backdoor account (dg) with a firmware-wide default password (…
-
Unscored —
Rooxis RXR-12 Wi-Fi router contains an unauthenticated remote code execution vulnerability in /usr/bin/cloud_manage, wh…
-
High 7.1
In Progress® Kendo® UI for jQuery versions from 2022.2.621 prior to 2026.4.1111 the DropDownButton and SplitButton allo…
-
Medium 6.0
repmgr 4.0.0 through 5.5.0 is affected by an OS command injection vulnerability (CWE-78) in event notifications. When e…
-
Medium 6.9
A potential vulnerability was reported in some Lenovo Tablets that could allow a third-party application to perform an …
-
Medium 4.8
A potential improper permissions vulnerability was reported in Lenovo XiangBangbang that could allow a local applicatio…
-
High 8.5
During an internal security assessment, a potential vulnerability was discovered in Lenovo PC Manager, distributed excl…
-
High 8.5
A deserialization of untrusted data vulnerability was discovered in Lenovo System Update that could allow a local authe…
-
High 7.0
An improper permissions vulnerability was reported in Lenovo System Update that could allow a local authenticated user …
-
Low 3.7
Double free after allocation failure in regcomp and regexec
The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and free the same heap block twice when a memory allocation fails while a regular expression is compiled or matched. The re_dfa_add_node (the NFA node tab…
-
High 8.2
soapbar: verify_envelope_bsp accepts an unauthenticated embedded certificate (signature forgery / authentication bypass)
soapbar is a SOAP library for Python — client, server, and WSDL handling. Prior to version 0.13.0, verify_envelope_bsp() derived its trust anchor from the message it was verifying. It read the X.509 certificate out of the caller-untrusted wsse:BinarySecurityT…
-
Medium 4.8
Calling the wide scanf family of functions (swscanf, fwscanf, wscanf, vswscanf, vfwscanf and vwscanf) with a %s or %[ c…
-
Unscored —
Apache XML Graphics Batik: Check url protocol when loading document
Origin Validation Error vulnerability in Apache XML Graphics Batik: the external resource same-origin check does not compare the URL protocol This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which f…
-
Medium 4.3
Team preferences RBAC bypass through the set-home-dash endpoint
Any authenticated user, including a Viewer, could change the preferences of any team, such as its home dashboard, theme and timezone, through an undocumented endpoint with no access control, and so redirect every member of that team to a dashboard of their ch…
-
Critical 9.0
Critical Remote Code Execution (RCE) vulnerability reported in Windchill
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.
-
Medium 5.5
Busybox: out-of-bounds read in volume_id_get_buffer() via an offset+length wraparound
A flaw was found in BusyBox. An integer overflow occurs in the volume_id component when calculating buffer boundaries while probing filesystem metadata. An attacker can exploit this vulnerability by providing a specially crafted filesystem image on an attache…
-
Unscored —
Apache XML Graphics FOP: CWE-502 unsafe deserialization in hyphenation loading
unsafe deserialization in hyphenation loading vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: through 2.11. Users are recommended to upgrade to version 2.12, which fixes the issue.
-
Unscored —
SSRF Vulnerability in Apache Batik
Server-Side Request Forgery (SSRF) vulnerability in Apache XML Graphics Batik. This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue.
-
Medium 6.5
Authorization bypass in the Git Sync provisioning jobs API
A user with the Editor role could delete, move, push or pull Git Sync managed resources in folders where they only had view access, by creating a provisioning job through the jobs resource API, which skipped the folder permission checks (incorrect authorizati…
-
Medium 6.5
Folder authorization bypass in the Git Sync provisioning files API
A user with edit access to one folder could modify, move or delete Git Sync provisioned resources in folders where they only had view access, through the provisioning files API (incorrect authorization).
-
Unscored —
Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers
Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from G…
-
Unscored —
Apache HTTP Server: mod_md NULL pointer dereference leads to child process crash
NULL pointer dereference vulnerability in Apache HTTP Server's mod_md during HTTP request processing. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.69.
-
High 7.1
Folder permission bypass in the Git Sync repository files API
A user with the Viewer or Editor role could bypass folder permissions on Git Sync managed resources through the repository files API: a Viewer could read files in folders they could not access, and an Editor could create, modify, move or delete provisioned da…