| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-64675 | 5.3 | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5 and 1.5.1, a single unauthenticated BACnet/IP UDP datagram (port 47808) triggers an out-of-bounds read in xy_color_decode() (src/bacnet/lighti | 2026-11-13 22:17:25 | 2026-11-13 19:19:33 |
| CVE-2026-63164 | 6.5 | Omnispace Agora Project through 26.10.0 contains an insecure direct object reference vulnerability that allows authenticated attackers to access another user's private mail by supplying a crafted reloadMailTypeId parameter to Ctrl::getCurObj() withou | 2026-11-13 22:17:25 | 2026-11-13 17:17:33 |
| CVE-2026-16664 | 5.1 | MCUboot's Zephyr serial-recovery upload handler bs_upload() in boot/boot_serial/src/boot_serial.c decodes the host-supplied image field of an MCUmgr image-upload request into img_num (a full 32-bit value) and latches it on the off == 0 packet without | 2026-11-13 22:17:25 | 2026-11-13 02:18:57 |
| CVE-2026-70640 | 7.0 | llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI wrapper where bench_1model() and free_1context() lack synchronization, allowing Thread A to operate on freed memory while Thread B con | 2026-11-13 22:17:25 | 2026-08-06 22:18:28 |
| CVE-2026-129137 | - | Incorrect default permissions in the agent configuration folder in Devolutions PowerShell Universal 2026.3.4 and earlier allows a local unprivileged user to execute arbitrary code as SYSTEM via a crafted agent configuration file that points the agent | 2026-11-13 22:17:24 | 2026-11-13 22:17:24 |
| CVE-2026-129169 | 5.4 | PMail 2.5.0 through 2.9.8 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by sending unsanitized HTML through /api/email/send. Attackers can embed event-handler payloads like img onerror that exe | 2026-11-13 22:17:24 | 2026-11-13 18:17:42 |
| CVE-2026-129165 | 9.1 | Tactical RMM 0.17.0 through 1.6.1 contains an arbitrary file read in the /reporting/templates/preview/ endpoint because WeasyPrint resolves file:// links in user-supplied template_md and embeds the files in the returned PDF. Users with report managem | 2026-11-13 22:17:24 | 2026-11-13 18:17:41 |
| CVE-2026-129161 | 7.4 | Dromara free-fs 2.0.1 through 2.3.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute-force six-digit password reset codes via PUT /apis/user/forget-password. Attackers can reques | 2026-11-13 22:17:24 | 2026-11-13 18:17:41 |
| CVE-2026-129156 | 5.4 | DjangoBlog commit d186b1c through commit 6134ed6 contains a stored cross-site scripting vulnerability that allows authenticated OAuth users to inject script via an unescaped nickname in comment reactions. Attackers can set their OAuth display name to | 2026-11-13 22:17:24 | 2026-11-13 18:17:40 |
| CVE-2026-129152 | 5.3 | SurveyKing 1.12.0 through 1.13.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to submit survey responses because AnswerServiceImpl.saveAnswer skips login-required and survey password checks. Attackers can subm | 2026-11-13 22:17:24 | 2026-11-13 18:17:39 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/40249
Zapisa po stranici: