406,096 results · Feed
-
Medium 5.9
WP Fastest Cache <= 1.5.3 - Unauthenticated Sensitive Information Exposure via Cached wp-activate.php Response
The WP Fastest Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.5.3. The plugin caches the response of Core’s wp-activate.php without honoring its no-store/no-cache headers, the wp-activate-* c…
-
Medium 6.5
Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of service
A flaw was found in libslirp in if_output(). When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm->m_nextpkt instead of the session queue head, corrupting queue pointers. A guest generating…
-
High 8.8
A buffer overflow vulnerability in the zdp_wtp binary in Zyxel NWA110AX firmware versions through 7.12(ABTG.0)C0 could …
-
High 8.8CVE-2026-107441 Public exploit
An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 co…
-
Medium 5.3
Octo STS discloses trust policy contents to unauthorized callers via Exchange error messages
Octo STS (github.com/octo-sts/app) before 0.11.2 returns trust policy configuration to callers whose OIDC token does not satisfy that policy. TrustPolicy.CheckToken included the policy's issuer, subject and audience values or patterns and claim_pattern names …
-
High 7.8
labbench before 0.46.1 Deserialization of Untrusted Data via read() Pickle Auto-Dispatch
labbench before 0.46.1 contains a deserialization of untrusted data vulnerability in read() and read_relational() that passes any file with a .p or .pickle extension to pandas.read_pickle based on the extension alone. Attackers who supply a crafted data file …
-
High 7.4
Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information disclosure
A flaw was found in libslirp in icmp_forward_error(). When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed packet could cause…
-
High 7.1CVE-2026-106991 Public exploit
hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or st…
-
Critical 9.8
An issue in im3x Scriptables through v2-dev branch allows attackers to inject arbitrary OS commands via uploading a fil…
-
Critical 9.8
A Zip Slip vulnerability in the /upload endpoint of codeskyblue gohttpserver through v1.3.0 allows attackers to write a…
-
High 7.5
A hardcoded session secret key in codeskyblue gohttpserver through v1.3.0 allows attackers to impersonate any user, byp…
-
High 8.7
Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO Neo EC and CW Edge Co…
-
Medium 4.3CVE-2026-120597 Scanner template
Welcart e-Commerce Plugin paymentESCOTT.main.class.php error_page_message cross site scripting
A vulnerability was identified in Welcart e-Commerce Plugin up to 2.12.6 on WordPress. This affects the function ESCOTT_MAIN::error_page_message of the file classes/paymentESCOTT.main.class.php. Such manipulation of the argument ResponseCd leads to cross site…
-
High 7.5
PyMuPDF 1.25.3 before 2.0 Stack Buffer Overflow via add_freetext_annot() Callout
PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in JM_set_annot_callout_line() that copies a caller-supplied number of callout points into a fixed three-element stack array. Attackers who control the callout argument passed to P…
-
Low 2.0
Hivex: hivex: denial of service via out-of-bounds read in big-data block processing
A flaw was found in hivex. By supplying a specially crafted Windows registry hive file, an attacker can trigger an out-of-bounds memory read when hivex parses registry values containing malformed large data block lists. This issue can cause the application pr…
-
High 8.7
NetX Secure DTLS server allocates a session for each new source before the cookie exchange and never reclaims it, so spoofed datagrams exhaust the session pool
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server allocates a session from its fixed session pool for the first datagram from any unrecognised address and port, before the cookie exchange, and never releases a session…
-
High 8.2
NULL pointer dereference in the BSD raw IPv6 send path when the destination table is full
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, built with BSD raw socket and IPv6 support, the IPv6 raw send path uses the destination-table entry it adds without checking that the add succeeded. When the destination table is full and an off-…
-
Medium 6.1
Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server
Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server (aws-serverless-mcp-server) before v0.2.1 might allow an actor who can influence the MCP agent to read the contents of JSON files o…
-
Critical 9.8CVE-2026-86596 Public exploit
s2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN Parameter
The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. This is due to insufficient sanitization in strip_php_tags_deep(), which only strips literal '<?'…
-
High 8.7
Temporal Server Kubernetes compute provider builds a client from caller-supplied configuration and runs a caller-chosen command on the Worker Service host
Temporal Server compiles a Worker Controller Instance module, go.temporal.io/auto-scaled-workers, into its Worker Service, and that module registers a compute provider named k8s whose function is to manage workers running in a Kubernetes cluster. The k8s prov…
-
High 8.7
Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact…
-
High 8.8
Improper link resolution before file access in cPanel allows remote authenticated users to write arbitrary root-owned f…
-
Medium 6.7
Konflux-ci: unquoted variable expansion in shell command execution
A flaw was found in konflux-ci. This vulnerability allows arbitrary code execution due to improper quoting of shell variables in deployment scripts. A local attacker who can supply arguments to the affected scripts could exploit this issue to trigger unintend…
-
High 8.4
In addDragDropListener of WindowManagerService.java, there is a possible permission bypass due to a missing permission …
-
Low 3.3
EchoHS GeekezBrowser Public API status information disclosure
A vulnerability was detected in EchoHS GeekezBrowser up to 1.7.2/1.8.0. This affects an unknown part of the file /api/status of the component Public API. The manipulation results in information disclosure. The attack requires a local approach. The exploit is …
-
High 7.1
Missing length validation in Absolute Secure Access
CVE-2026-116768 is a missing length validation vulnerability in Secure Access servers prior to 14.61. Authenticated attackers can cause a persistent denial of service when connecting for the first time.
-
Medium 6.7
In is_valid_header of timed_cache_item.c, there is a possible out-of-bounds write due to a missing bounds check. This c…
-
High 8.8
ReadyMedia 1.3.0 - 1.3.3 Stack Buffer Overflow via DFF Parser
ReadyMedia (formerly MiniDLNA) versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow vulnerability that allows remote attackers to corrupt stack memory by crafting a malicious DFF audio file with an oversized PROP chunk size value that is used un…
-
High 7.1
Improper input handling in Secure Access servers
CVE-2026-116767 is an improper input handling vulnerability in Secure Access servers prior to 14.61. Authenticated attackers can cause a persistent denial of service.
-
High 7.8
An unprivileged application can exploit a lack of package/signature validation in SystemUI's `RemoteQCController` when …
-
Medium 6.7
The vulnerability is a Use-After-Free (UAF) in the EVS AIDL HAL, arising from a data race on an unsynchronized `std::we…
-
Low 2.5
A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a `buffer_handle_t` wh…
-
High 7.8
The report details a heap Use-After-Free (UAF) vulnerability within the `android.hardware.automotive.evs-default` HAL s…
-
High 7.5
The vulnerability is a heap out-of-bounds read in the EVS HAL's `getStreamList()` method. An attacker can craft a `Came…
-
Medium 6.1
A physical occupant on an Android Automotive OS (AAOS) Multi-User Multi-Display (MUMD) passenger display can view sensi…
-
High 7.8
An unprivileged application can bypass the `android.car.permission.CAR_DISPLAY_IN_CLUSTER` permission by registering an…
-
Medium 5.3
The `ClusterRenderingService.dump()` method, accessible to processes holding `android.permission.DUMP` and `android.per…
-
High 8.3
Improper input handling in Secure Access server
CVE-2026-116766 is an improper input handling vulnerability in the Secure Access server versions between 13.0 and prior to 14.61. Attackers can cause a persistent denial of service of the server.
-
High 7.8
CVE-2026-16305
Local privilege escalation in `SmartUpdate.exe` and `SmartExecute.exe` in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a local low-privileged attacker to execute arbitrary commands with administrator privileges via modification of a world-writable `exec…
-
Low 3.5
Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Authorization in Handler for Cus…