405,225 results · Feed
-
High 7.7
Adobe Connect is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could …
-
Critical 9.6
Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged…
-
Critical 9.4
Adobe Connect | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability to execute arbitrary SQL commands, p…
-
Critical 9.9
Adobe Connect | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories …
-
High 8.7
Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged…
-
Critical 9.9
Adobe Connect | Improper Control of Generation of Code ('Code Injection') (CWE-94)
Adobe Connect is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arb…
-
Medium 6.1
Product Filter for WooCommerce by WBW <= 3.4.5 - Reflected Cross-Site Scripting via 'text_no_products' Parameter
The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'text_no_products' parameter in all versions up to, and including, 3.4.5 due to insufficient input sanitization and output escaping. This ma…
-
Critical 9.8CVE-2026-89324 Public exploit
The Basel Post Types plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, …
-
Medium 4.7
Active Support: Possible XSS vulnerability in Active Support MessagePack serializer
Active Support is a collection of utility classes and standard library extensions used by Rails and other Ruby projects. From 8.1 until 8.1.4.1, ActiveSupport::MessagePack serializes an ActiveSupport::SafeBuffer as its bytes alone and deserializes it as a new…
-
High 8.3
The graphql-proxy-cache-advanced plugin in Kong Gateway Enterprise omits the caller's identity from the cache key, allo…
-
Medium 4.8
Action Pack: Possible cache poisoning in Action Pack content negotiation
Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack negotiates the format of a rendered response from the Accept, X-Requested-With and, for XHR requests without Accept, Content-Type request headers…
-
High 8.3
Improper neutralization of HTTP headers for scripting syntax vulnerability in N-able N-central allows Cross-Site Script…
-
High 8.6
Relative path traversal vulnerability in N-able N-central allows Path Traversal. This issue affects N-central: before 2…
-
High 8.2
Dimension | Improper Input Validation (CWE-20)
Dimension is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this is…
-
Critical 9.3
Server-Side request forgery (SSRF) vulnerability in N-able N-central allows Server Side Request Forgery. This issue aff…
-
Medium 5.3
Active Storage: Possible DoS vulnerability in Active Storage proxy mode via storage errors during streaming
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. From 8.0 until 8.0.5.2 and 8.1.4.1, when Active Storage serves a file through its proxy controllers, ActiveStorage::Streaming#send_…
-
High 8.7
The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway omit the request hostna…
-
High 8.6
Local privilege escalation to root via nable-writable syslog-ng config
Incorrect privilege assignment vulnerability in N-able N-central allows Privilege Escalation. This issue affects N-central: before 26.4.1.
-
High 8.7
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in N-able N-central …
-
High 7.5
Root RCE via unsigned NSP upgrade package upload
Download of code without integrity check vulnerability in N-able N-central allows Remote Code Inclusion. This issue affects N-central: through 24.6.1.
-
High 7.4
Action Pack: Possible IP spoofing in Action Dispatch RemoteIp
Action Pack is a framework for handling and responding to web requests. From 8.1 until 8.1.4.1, Since Rails 8.1.0, ActionDispatch::RemoteIp derives request.remote_ip from Rack::Request#forwarded_for, which under Rack 3 reads the RFC 7239 Forwarded header in p…
-
High 8.4
Insecure IPC Channels lead to local privilege escalation
Missing authentication for critical function vulnerability in N-able N-central allows Privilege Escalation. This issue affects N-central: before 2026.4.1.
-
Medium 5.5
CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could res…
-
Medium 6.5
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security featu…
-
Medium 5.9
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security featu…
-
Medium 6.5
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to applicatio…
-
Medium 5.1
CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security…
-
Medium 5.9
CAI Content Credentials is affected by a Use of a Broken or Risky Cryptographic Algorithm vulnerability that could resu…
-
Medium 5.9
CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could res…
-
Medium 5.9
CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could res…
-
Medium 5.5
CAI Content Credentials is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'…
-
Medium 4.0
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security featu…
-
Medium 4.0
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to applicatio…
-
Low 2.9
CAI Content Credentials is affected by an Incorrect Authorization vulnerability that could result in a Security feature…
-
Low 3.7
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security featu…
-
Critical 9.3
Multiple XXE Vulnerabilities
Improper restriction of XML external entity reference vulnerability in N-able N-central allows XML Schema Poisoning. This issue affects N-central: before 26.4.1.
-
Medium 4.2
Action Pack: Possible restoration of destroyed sessions in Action Dispatch CacheStore
Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, ActionDispatch::Session::CacheStore writes a session back to the cache at the end of each request that loaded it, without checking that the session's cache e…
-
High 8.8
Active Storage: Possible arbitrary file read and remote code execution in Active Storage video previews, analysis and image processing
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Blob#open writes a blob to a tempfile whose name carries the extension of the uploaded…
-
Unscored —
The Auth0 ASP.NET Core Authentication SDK incorrectly determines a session's OIDC Back-Channel Logout status, which may…
-
Medium 5.3
Active Storage: Possible circumvention of file size limits in Active Storage direct uploads to Google Cloud Storage
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Service::GCSService#url_for_direct_upload does not bind the declared content length in…