| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-117609 | 7.1 | rtl_433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2_mc() that allows nearby attackers to write past a 7-byte stack buffer by sending more than seven valid Manchester-coded words. Attackers can transmit a crafted OO | 2026-10-28 03:17:12 | 2026-10-28 03:17:12 |
| CVE-2026-117608 | 6.1 | Assimp through 6.0.5 contains an integer overflow vulnerability in MD2Importer::ValidateHeader() that allows attackers to bypass frame table bounds checks using crafted header fields. Attackers can supply a malicious .md2 file whose numFrames and num | 2026-10-28 03:17:12 | 2026-10-28 03:17:12 |
| CVE-2026-117607 | 7.2 | Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via import_language.php containing | 2026-10-28 03:17:12 | 2026-10-28 03:17:12 |
| CVE-2026-117606 | 5.4 | NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions because CashRegistersService never compares used_by with the user. Attackers holding the default n | 2026-10-28 03:17:12 | 2026-10-28 03:17:12 |
| CVE-2026-117605 | 4.3 | nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticate | 2026-10-28 03:17:11 | 2026-10-28 03:17:11 |
| CVE-2026-115624 | 5.3 | GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited status may modify | 2026-10-28 03:17:11 | 2026-10-28 03:17:11 |
| CVE-2026-115207 | 5.5 | A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch r | 2026-10-28 03:17:11 | 2026-10-22 11:17:50 |
| CVE-2026-114730 | 7.2 | Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use | 2026-10-28 03:17:11 | 2026-10-22 03:16:38 |
| CVE-2026-114726 | 5.8 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control characters from the decoded display name, so a received | 2026-10-28 03:17:11 | 2026-10-22 02:17:00 |
| CVE-2026-114722 | 6.5 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcube_utils::mod_css_styles() did not treat an at-rule prologue such as @layer a; as a selector boundary, and did not handle selectors beginn | 2026-10-28 03:17:11 | 2026-10-22 02:17:00 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/39679
Zapisa po stranici: