405,004 results · Feed
-
Medium 6.1
A remote code execution (RCE) vulnerability in Palo Alto Networks PAN-OS® software on Panorama enables an authenticated…
-
Medium 6.6
An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated remote attack…
-
Medium 4.3
Missing rate limiting, per-account submission quota and geographic validation in the publicar_aviso RPC function in Lag…
-
High 7.6
AsiaInfo BSS Platform 9.2 before 9.2.38 has a stored cross-site scripting (XSS) vulnerability in the menu icon upload f…
-
High 7.5
Webmin through 2.670 Users File Injection via acl/cert_issue.cgi
Webmin through 2.670 contains a users file injection vulnerability in acl/cert_issue.cgi that allows authenticated Webmin users to inject lines by supplying unvalidated certificate DN fields containing newlines. Attackers can end a DN field with a backslash a…
-
High 7.2
Webmin through 2.670 Privilege Escalation via acl/save_group.cgi
Webmin through 2.670 contains a privilege escalation vulnerability in acl/save_group.cgi that allows delegated administrators to grant unauthorized modules by submitting arbitrary module lists in the mod parameter. Attackers with Webmin Users module access ca…
-
High 7.5
Spatie Browsershot 2.2.0 before 5.5.0 Local File Read via setHtml()
Spatie Browsershot 2.2.0 before 5.5.0 contains a local file read vulnerability that allows attackers to read server files by supplying root-relative references in HTML passed to setHtml(). Attackers can embed iframe, img, link or script elements referencing p…
-
Medium 5.4
Wallos 4.4.0 before 5.10.3 Stored XSS via sendnotifications.php
Wallos 4.4.0 before 5.10.3 contains a stored cross-site scripting vulnerability in endpoints/cronjobs/sendnotifications.php that allows registered users to inject scripts via unescaped notification service responses. Attackers can point their Mattermost webho…
-
High 7.4
Traccar 3.15 before 6.17.0 Authentication Bypass via Empty LDAP Password
Traccar 3.15 before 6.17.0 contains an authentication bypass vulnerability in LdapProvider.login() that fails to reject empty passwords, causing LDAP binds to be performed as unauthenticated binds when LDAP authentication is enabled. Unauthenticated attackers…
-
Medium 5.3
SiYuan 3.7.0 before 3.8.10 Path Traversal File Write via MCP web_fetch
SiYuan 3.7.0 before 3.8.10 on Windows contains a path traversal vulnerability in kernel/util/webfetch.go that allows attackers to write files outside the import directory via backslash-encoded filenames. Attackers controlling a URL fetched by the MCP web_fetc…
-
Medium 4.2
Social-auth-core 4.7.0 before 7.0.0 Login CSRF via SAML RelayState
Social-auth-core 4.7.0 before 7.0.0 contains a login cross-site request forgery vulnerability in the SAML backend that restores sessions named in the unsigned RelayState parameter. Attackers can deliver their own valid IdP response and RelayState to a victim'…
-
High 8.2
@tinacms/mdx before 2.4.2 Code Injection via MDX Serializer Rich-Text Values
@tinacms/mdx before 2.4.2 contains a code injection vulnerability in its MDX serializer, which writes rich-text values into MDX expressions without escaping them. Authenticated content editors can save crafted values that break out of list field or highlightC…
-
High 7.8
A flaw was found in the xfs_admin utility in xfsprogs. The tool does not properly validate user-supplied parameters, al…
-
High 7.5
A flaw was found in Cockpit. This vulnerability allows a remote attacker, without prior authentication, to send special…
-
High 7.5
A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacke…
-
Medium 5.9
A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and clearte…
-
High 7.1
Fider is a feedback portal for feature requests and suggestions. Prior to version 0.34.0, a Server-Side Request Forgery…
-
High 8.7
Dell OpenManage Ansible Modules, versions 2.1.2 through 10.0.3, contains an Improper Certificate Validation vulnerabili…
-
Critical 9.6
Fider is a feedback portal for feature requests and suggestions. Prior to version 0.36.0, in multi-tenant mode (HOST_MO…
-
High 7.5
A use-after-free in Node.js HTTP/2 lets an unauthenticated client corrupt server memory, over both TLS and cleartext, w…
-
High 7.3
Pappl-retrofit: directory traversal in the add-ppdfiles and delete-ppdfiles actions
A flaw was found in pappl-retrofit. The application fails to properly sanitize user-supplied filenames when handling the upload and deletion of PostScript Printer Description (PPD) files. A remote, unauthenticated attacker can exploit this directory traversal…
-
High 8.7
Dell Ansible Storage for Unity , versions prior to 1.2.13 contains an Improper Certificate Validation vulnerability in …
-
High 8.8
Dell Terraform for ObjectScale and Powerstore, versions prior to 1.1.1 (ObjectScale) and versions 1.2.1 through 1.3.0 (…
-
Medium 5.5
Dell Ansible Storage for PowerStore, versions prior to 3.9.0,contains an Insertion of Sensitive Information into Log Fi…
-
High 7.4
Dell Ansible Storage for PowerStore, versions prior to 3.9.0, contains an Improper Certificate Validation vulnerability…
-
Medium 6.6
Dell Terraform Provider for Dell PowerFlex contain(s) an OS Command Injection Vulnerability in the SDC host provisionin…
-
High 8.1
A client certificate authentication bypass in Node.js TLS lets a client change the servername during TLS 1.2 renegotiat…
-
High 8.7
sync-rpc runs asynchronous commands synchronously by putting them in a separate proces. Prior to version 1.3.7, if an a…
-
High 7.6
Dell OpenManage Ansible Modules, versions 6.0.0 through 10.0.3, contains an Improper Neutralization of Special Elements…
-
Medium 6.8
A certificate validation bypass in Node.js https.Agent lets a cached TLS session authenticated under one CA policy be r…
-
Medium 4.6
CWE- 416: Use After Free vulnerability exists that could cause arbitrary code execution when a local attacker could tri…
-
Low 3.5
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Prior to versions 2.12.7…
-
Medium 6.2
Node.js discloses proxy credentials in ERR_PROXY_INVALID_CONFIG error messages. CVE-2026-48615 established that a proxy…
-
High 7.6
Dell OpenManage Ansible Modules, versions 2.0.2 through 10.0.3, contains an Improper Neutralization of Special Elements…
-
Medium 5.9
An unauthenticated HTTP/2 client can exhaust Node.js server memory because inbound DATA queued on an undrained stream i…
-
Medium 6.9
iopress is a native HTTP server for Node.js with platform-specific async I/O. Prior to version 1.0.5, the chunked-trans…
-
Medium 4.2
A per-host mutual-TLS authorization bypass in Node.js lets a client authorized for the default hostname reach a protect…
-
Medium 5.5
Dell OpenManage Ansible Modules, versions 2.0.4 through 10.0.3, contains an Improper Restriction of XML External Entity…
-
High 7.5
A use-after-free in Node.js HTTP/2 stream teardown can leak response memory, including the contents of other connection…
-
High 7.5
geojson-vt is a JavaScript library for slicing GeoJSON data into vector tiles on the fly, primarily designed to enable …