2,472 results · Clear filters · Feed
-
Medium 5.5CVE-2026-2898 Public exploit
funadmin Backend Endpoint AuthCloudService.php getMember deserialization
A vulnerability was detected in funadmin up to 7.1.0-rc4. This issue affects the function getMember of the file app/common/service/AuthCloudService.php of the component Backend Endpoint. The manipulation of the argument cloud_account results in deserializatio…
-
High 8.6CVE-2026-2472 Public exploit
Stored Cross-Site Scripting (XSS) in Vertex AI Python SDK Visualization
Stored Cross-Site Scripting (XSS) in the _genai/_evals_visualization component of Google Cloud Vertex AI SDK (google-cloud-aiplatform) versions from 1.98.0 up to (but not including) 1.131.0 allows an unauthenticated remote attacker to execute arbitrary JavaSc…
-
Low 3.3CVE-2026-4040 Public exploit
OpenClaw File Existence tools.exec.safeBins information exposure
A vulnerability was identified in OpenClaw up to 2026.2.17. This issue affects the function tools.exec.safeBins of the component File Existence Handler. The manipulation leads to information exposure through discrepancy. The attack needs to be performed local…
-
Medium 6.3CVE-2026-27199 Public exploit
Werkzeug safe_join() allows Windows special device names
Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as filenames if preceded by other path segments. This was previously reported as GHSA-hgf8-39gv-g3f2, but the added filterin…
-
Critical 9.4CVE-2026-27212 Public exploit
Swiper has a Prototype Pollution Vulnerability
Swiper is a free and mobile touch slider with hardware accelerated transitions and native behavior. Versions 6.5.1 through 12.1.1 have a Prototype pollution vulnerability. The vulnerability resides in line 94 of shared/utils.mjs, where the indexOf() function …
-
Critical 10.0CVE-2026-26030 Public exploit
Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution
Semantic Kernel, Microsoft's semantic kernel Python SDK, has a remote code execution vulnerability in versions prior to 1.39.4, specifically within the `InMemoryVectorStore` filter functionality. The problem has been fixed in version `python-1.39.4`. Users sh…
-
High 8.1CVE-2026-25940 Public exploit
jsPDF's PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property)
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to on…
-
High 8.1CVE-2026-25755 Public exploit
jsPDF has PDF Object Injection via Unsanitized Input in addJS Method
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the argument of the `addJS` method allows an attacker to inject arbitrary PDF objects into the generated document. By crafting a payload that escapes the JavaScript string deli…
-
Critical 9.3CVE-2026-26988 Public exploit
LibreNMS: SQL Injection in ajax_table.php spreads through a covert data stream
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below contain an SQL Injection vulnerability in the ajax_table.php endpoint. The application fails to properly sanitize or parameterize user input when processi…
-
Critical 9.4
Ghost has a SQL Injection in its Content API
Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.
-
Medium 5.9CVE-2026-26189 Public exploit
Trivy Action has a script injection via sourced env file in composite action
Trivy Action runs Trivy as GitHub action to scan a Docker container image for vulnerabilities. A command injection vulnerability exists in `aquasecurity/trivy-action` versions 0.31.0 through 0.33.1 due to improper handling of action inputs when exporting envi…
-
Medium 6.5CVE-2026-24733 Public exploit
Apache Tomcat: Security constraint bypass with HTTP/0.9
Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to allow HEAD requests to a URI but deny GET requests, the user could bypass that constraint on GET req…
-
High 7.1CVE-2026-25232 Public exploit
Gogs has a Protected Branch Deletion Bypass in Web Interface
Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have an access control bypass vulnerability which allows any repository collaborator with Write permissions to delete protected branches (including the default branch) by sending a dire…
-
Medium 6.6CVE-2026-24126 Public exploit
Weblate has an argument injection in management console
Weblate is a web based localization tool. Prior to 5.16.0, the SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument injection to `ssh-add`. Version 5.16.0 fixes the issue. As a workaround, pro…
-
Critical 9.8
Milvus Allows Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise
Milvus is an open-source vector database built for generative AI applications. Prior to 2.5.27 and 2.6.10, Milvus exposes TCP port 9091 by default, which enables authentication bypasses. The /expr debug endpoint uses a weak, predictable default authentication…
-
Critical 9.8CVE-2026-21531 Public exploit
Azure SDK for Python Remote Code Execution Vulnerability
Deserialization of untrusted data in Azure SDK allows an unauthorized attacker to execute code over a network.
-
Critical 9.3
FUXA Unauthenticated Remote Arbitrary Scheduler Write
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through version 1.2.10, an authorization bypass vulnerability in the FUXA allows an unauthenticated, remote attacker to create and modify arbitrary schedulers, exposing conne…
-
Critical 9.5CVE-2026-25938 Public exploit
FUXA Unauthenticated Remote Code Execution in Node-RED Integration
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to execute arbitrary code on the server when the Node-RED plugin is …
-
High 8.1CVE-2026-25890 Public exploit
File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to 2.57.1, an authenticated user can bypass the application's "Disallow" file path rules by modifying the …
-
High 8.1CVE-2026-1529 Public exploit
Org.keycloak.services.resources.organizations: keycloak: unauthorized organization registration via improper invitation token validation
A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the attack…
-
High 8.7CVE-2026-24419 Public exploit
OpenSTAManager has an SQL Injection in the Prima Nota module
OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contain a critical Error-Based SQL Injection vulnerability in the Prima Nota (Journal Entry) module's add.php file. The application …
-
High 8.7CVE-2026-24418 Public exploit
OpenSTAManager has an SQL Injection vulnerability in the Scadenzario bulk operations module
OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contain a critical Error-Based SQL Injection vulnerability in the bulk operations handler for the Scadenzario (Payment Schedule) mod…
-
High 8.7CVE-2026-24417 Public exploit
OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service
OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contain a critical Time-Based Blind SQL Injection vulnerability in the global search functionality. The application fails to properl…
-
High 8.7CVE-2026-24416 Public exploit
OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module
OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contain a critical Time-Based Blind SQL Injection vulnerability in the article pricing completion handler. The application fails to …
-
High 7.2CVE-2026-24135 Public exploit
Gogs vulnerable to arbitrary file deletion via path traversal in wiki page update
Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, a path traversal vulnerability exists in the updateWikiPage function of Gogs. The vulnerability allows an authenticated user with write access to a repository's wiki to delete arbitr…
-
High 8.7CVE-2025-69216 Public exploit
OpenSTAManager has an SQL Injection in Scadenzario Print Template
OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, an authenticated SQL injection vulnerability in OpenSTAManager's Scadenzario (Payment Schedule) print template allows any authenticated user to …
-
High 8.7CVE-2025-69214 Public exploit
OpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint)
OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, an SQL Injection vulnerability exists in the ajax_select.php endpoint when handling the componenti operation. An authenticated attacker can inje…
-
Critical 9.4CVE-2025-69212 Public exploit
OpenSTAManager has an OS Command Injection in P7M File Processing
OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, a critical OS Command Injection vulnerability exists in the P7M (signed XML) file decoding functionality. An authenticated attacker can upload a…
-
Low 1.1CVE-2026-1337 Public exploit
Insufficient escaping of unicode characters in query log
Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j products, but this advisor…
-
High 7.5CVE-2026-25732 Public exploit
NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write
NiceGUI is a Python-based UI framework. Prior to 3.7.0, NiceGUI's FileUpload.name property exposes client-supplied filename metadata without sanitization, enabling path traversal when developers use the pattern UPLOAD_DIR / file.name. Malicious filenames cont…
-
Critical 9.8CVE-2026-25544 Public exploit
Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters
Payload is a free and open source headless content management system. Prior to 3.73.0, when querying JSON or richText fields, user input was directly embedded into SQL without escaping, enabling blind SQL injection attacks. An unauthenticated attacker could e…
-
High 8.2CVE-2026-23989 Public exploit
REVA Public Link Exploit
REVA is an interoperability platform. Prior to 2.42.3 and 2.40.3, a bug in the GRPC authorization middleware of the "Reva" component of OpenCloud allows a malicious user to bypass the scope verification of a public link. By exploiting this via the the "archiv…
-
Critical 9.5
FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through ver…
-
Critical 10.0CVE-2026-25632 Public exploit
EPyT-Flow has unsafe JSON deserialization (__type__)
EPyT-Flow is a Python package designed for the easy generation of hydraulic and water quality scenario data of water distribution networks. Prior to 0.16.1, EPyT-Flow’s REST API parses attacker-controlled JSON request bodies using a custom deserializer (my_lo…
-
Critical 9.9CVE-2025-62878 Public exploit
Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern
A malicious user can manipulate the parameters.pathPattern to create PersistentVolumes in arbitrary locations on the host node, potentially overwriting sensitive files or gaining access to unintended directories.
-
High 7.8CVE-2026-25546 Public exploit
Godot MCP is vulnerable to Command Injection via unsanitized projectPath
Godot MCP is a Model Context Protocol (MCP) server for interacting with the Godot game engine. Prior to version 0.1.1, a command injection vulnerability in godot-mcp allows remote code execution. The executeOperation function passed user-controlled input (e.g…
-
Critical 9.4CVE-2026-25053 Public exploit
n8n is Vulnerable to OS Command Injection in Git Node
n8n is an open source workflow automation platform. Prior to versions 1.123.10 and 2.5.0, vulnerabilities in the Git node allowed authenticated users with permission to create or modify workflows to execute arbitrary system commands or read arbitrary files on…
-
Critical 9.4CVE-2026-25049 Public exploit
n8n Has an Expression Escape Vulnerability Leading to RCE
n8n is an open source workflow automation platform. Prior to versions 1.123.17 and 2.5.2, an authenticated user with permission to create or modify workflows could abuse crafted expressions in workflow parameters to trigger unintended system command execution…
-
Medium 6.5CVE-2026-24514 Public exploit
ingress-nginx Admission Controller denial of service
A security issue was discovered in ingress-nginx where the validating admission controller feature is subject to a denial of service condition. By sending large requests to the validating admission controller, an attacker can cause memory consumption, which m…
-
Medium 5.5CVE-2026-25541 Public exploit
Bytes is vulnerable to integer overflow in BytesMut::reserve
Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "v_capacity >= new_cap + offset" uses an un…