405,004 results · Feed
-
Critical 9.1
A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7…
-
High 7.5
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.…
-
High 7.5
A out-of-bounds write vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail…
-
High 7.2
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet …
-
Critical 9.1
A incorrect authorization vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, Forti…
-
Critical 9.1
A improper authentication vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, Forti…
-
High 7.5
A integer overflow or wraparound vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6…
-
Critical 9.1
A weak password recovery mechanism for forgotten password vulnerability in Fortinet FortiMail 8.0.0, FortiMail 7.6.0 th…
-
Critical 9.8
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet …
-
High 7.2
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet …
-
High 8.8
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet …
-
High 7.2
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet …
-
Unscored —
Improper access control in the autofill vault search in Devolutions Server 2026.3.13.0 and earlier allows an authentica…
-
Unscored —
Improper access control in the administrative role assignment endpoint in Devolutions Server 2026.3.13.0 and earlier al…
-
Unscored —
Insertion of sensitive information into sent data in the user list endpoint in Devolutions Server 2026.3.13.0 and earli…
-
Unscored —
Insertion of sensitive information into sent data in the user endpoints in Devolutions Server 2026.3.13.0 and earlier a…
-
Unscored —
Improper access control in the connection history in Devolutions Server 2026.3.13.0 allows an authenticated user withou…
-
High 7.1
An internal security review identified a development regression from ThinkSystem v4 XClarity Controller 3 (XCC3) versio…
-
Medium 5.8
Improper neutralization of special elements used in an OS command in the remote SSH operation functionality of Lenovo X…
-
Medium 5.2
A path traversal vulnerability in the TAR.GZ extraction logic of Lenovo XClarity Essentials OneCLI 5.5.0 for Linux coul…
-
Medium 5.2
A path traversal vulnerability in the ZIP extraction logic of Lenovo XClarity Essentials OneCLI 5.5.0 for Linux could a…
-
High 8.6
Improper neutralization of special elements used in an OS command in Lenovo XClarity Integrator for Microsoft Windows A…
-
High 8.7
NULL-pointer dereference (DoS) in nginx-http-flv-module
nginx-http-flv-module is a media streaming server based on nginx-rtmp-module. Prior to version 1.2.14, if a server received an HTTP/1.0 request without a header Host, which was permitted by HTTP core of Nginx, then r->headers_in.host was NULL, nginx-http-flv-…
-
Medium 6.4
Laradocs: Command injection via unescaped Node.js binary path in KaTeX SSR
Laradocs maintains version-controlled documentation inside a Laravel codebase. From version 0.4.0 to before version 1.0.0, Laradocs is vulnerable to local command injection in server-side KaTeX rendering via an unescaped Node.js binary path in a proc_open() c…
-
High 7.1
ideon: SSRF protection bypass via IPv6 transition addresses (NAT64 / 6to4 / IPv4-mapped) in link preview
ideon is a self-hosted visual workspace. Prior to version 0.9.6, the SSRF protection in safeFetch is bypassed by IPv6 transition addresses that embed private IPv4 addresses. The isPrivateIP function in src/app/lib/ssrf.ts checks only a narrow set of IPv6 rang…
-
Medium 6.9
ideon: Unauthenticated /api/links/preview endpoint is an open SSRF relay, and its IP blocklist misses the 0.0.0.0/:: unspecified-address bypass
ideon is a self-hosted visual workspace. Prior to version 0.9.5, ideon's link-preview endpoint requires no authentication at all and forwards any URL a caller supplies straight into a server-side fetch. The app does have a general-purpose SSRF guard (safeFetc…
-
Medium 5.3
ideon: Unauthenticated SSRF in /api/proxy/image via WHATWG bracketed/hex-mapped IPv6 bypass of isSafeUrl guard
ideon is a self-hosted visual workspace. Prior to version 0.9.4, validateUrlForSSRF() / safeFetch() in lib/oauth/ssrf-protection.ts (and the parallel validateMcpUrl() in lib/security/validators.ts) perform SSRF host-blocking by string/regex matching on new UR…
-
High 8.7
ideon: Read-only project viewers can wipe and rewrite the canvas and tamper with blocks/files via role-unchecked project endpoints
ideon is a self-hosted visual workspace. Prior to version 0.9.4, several project mutation endpoints under /api/projects/[id]/* resolve the caller's project role but never enforce it, so a user who was granted only the read-only viewer role on a project can pe…
-
High 8.5
Server-side request forgery in the server registration and update API in mcp-gateway-registry
Server-side request forgery (SSRF) in the server registration and update API in Amazon mcp-gateway-registry before 1.35.0 might allow an authenticated remote user to send requests from the gateway to internal network services and cloud instance metadata endpo…
-
Medium 6.9
Helio: Dashboard sideband CORS origin allowlist matches hostnames by prefix, admitting attacker-controlled origins in open mode
Helio is an MCP proxy that sits between AI agents and the tools they use. Prior to version 0.8.0, the dashboard sideband (default 127.0.0.1:3100) validated CORS request origins by matching the hostname against a private-network string prefix (10., 172.16.–172…
-
High 8.8
Missing authorization on the external management API in mcp-gateway-registry enables privilege escalation to registry administrator
Missing authorization in the external management API in Amazon mcp-gateway-registry 1.0.9 through 1.24.7 might allow an authenticated remote user to assign the registry administrator scope to their own identity group and obtain administrative control of every…
-
High 8.1
Pre-account hijacking in the authentication flow in Lagarto Chivato 0.4.1 and earlier on Web allows remote unauthentica…
-
Low 1.1
A server-side request forgery vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local unauthentica…
-
Medium 5.9
An incorrect privilege management vulnerability in the OPSWAT MetaDefender Endpoint Security SDK used by the Palo Alto …
-
Low 1.3
An authorization bypass vulnerability in the GlobalProtect gateway of Palo Alto Networks PAN-OS® software enables an au…
-
Low 1.7
A buffer overflow vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to disrupt se…
-
Low 2.3
A privilege escalation vulnerability in the GlobalProtect gateway of Palo Alto Networks PAN-OS® software enables an aut…
-
High 7.3
A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit…
-
Low 2.7
Authentication bypass vulnerabilities in the GlobalProtect™ portal and gateway of Palo Alto Networks PAN-OS® software e…
-
Medium 4.6
A buffer overflow vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network…