[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-76471 | 7 Oct 2026 | CVSS 9.8 | Cisco NX-OS SoftwareA vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root… | |
| CVE-2026-76472 | 7 Oct 2026 | CVSS 8.8 | Cisco Campus Gateway SoftwareAs part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive… | |
| CVE-2026-76480 | 7 Oct 2026 | CVSS 9.8 | Cisco License On-PremAs part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart… | |
| CVE-2026-76482 | 7 Oct 2026 | CVSS 10.0 | Cisco License On-PremAs part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart… | |
| CVE-2026-76483 | 7 Oct 2026 | CVSS 9.1 | Cisco License On-PremAs part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart… | |
| CVE-2026-76464 | 7 Oct 2026 | CVSS 9.6 | Cisco Campus Gateway SoftwareAs part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive… | |
| CVE-2026-76465 | 7 Oct 2026 | CVSS 9.8 | Cisco NX-OS SoftwareA vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software for Cisco Nexus 3000 Series Switches and… | |
| CVE-2026-76467 | 7 Oct 2026 | CVSS 7.5 | Cisco Campus Gateway SoftwareAs part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive… | |
| CVE-2026-76468 | 7 Oct 2026 | CVSS 8.2 | Cisco Campus Gateway SoftwareAs part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive… | |
| CVE-2026-76469 | 7 Oct 2026 | CVSS 7.4 | Cisco Campus Gateway SoftwareAs part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive… | |
| CVE-2026-76457 | 7 Oct 2026 | CVSS 8.6 | Cisco NX-OS SoftwareAs part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive… | |
| CVE-2026-76458 | 7 Oct 2026 | CVSS 8.6 | Cisco NX-OS SoftwareAs part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive… | |
| CVE-2026-76459 | 7 Oct 2026 | CVSS 9.8 | Cisco NX-OS SoftwareAs part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive… | |
| CVE-2026-76463 | 7 Oct 2026 | CVSS 8.8 | Cisco Campus Gateway SoftwareAs part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive… | |
| CVE-2026-76453 | 7 Oct 2026 | CVSS 8.8 | Cisco NX-OS SoftwareAs part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive… | |
| CVE-2026-76454 | 7 Oct 2026 | CVSS 9.1 | Cisco License On-PremA vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could… | |
| CVE-2026-76455 | 7 Oct 2026 | CVSS 9.8 | Cisco NX-OS SoftwareAs part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive… | |
| CVE-2026-76456 | 7 Oct 2026 | CVSS 8.6 | Cisco NX-OS SoftwareAs part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive… | |
| CVE-2026-62176 | 7 Oct 2026 | CVSS 9.1 | PraisonAI: Code Injection via f-string Interpolation in Deploy API Server GenerationPraisonAI is a multi-agent teams system. Prior to version 4.6.78, the `deploy/api.py` module generates Python server code by directly interpolating… | Fix |
| CVE-2026-62251 | 7 Oct 2026 | CVSS 8.1 | Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/queryHomer is open source telecom observability software. Prior to version 11.0.283, the `V4StatisticsQuery` handler passes the user-supplied `rawquery`… | Fix |
| CVE-2026-62252 | 7 Oct 2026 | CVSS 9.8 | Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First LoginHomer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the… | Fix |
| CVE-2026-62253 | 7 Oct 2026 | CVSS 9.8 | Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)Homer is open source telecom observability software. Prior to version 11.0.283, both JWT middleware functions (`JWTMiddleware` and `JWTMiddlewareV4`)… | Fix |
| CVE-2026-76437 | 7 Oct 2026 | CVSS 4.9 | Cisco License On-PremA vulnerability in the web-based user interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an… | |
| CVE-2026-76452 | 7 Oct 2026 | CVSS 4.9 | Cisco License On-PremA vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could… | |
| CVE-2026-20321 | 7 Oct 2026 | CVSS 6.5 | Cisco Application Policy Infrastructure Controller (APIC)A vulnerability in the web-based management API for Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote… | |
| CVE-2026-20328 | 7 Oct 2026 | CVSS 9.1 | Cisco License On-PremA vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could… | |
| CVE-2026-20362 | 7 Oct 2026 | CVSS 7.2 | Cisco FinesseA vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct server-side request… | |
| CVE-2026-20032 | 7 Oct 2026 | CVSS 4.4 | Cisco NX-OS SoftwareA vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, local attacker with low privileges to escape the… | |
| CVE-2026-20038 | 7 Oct 2026 | CVSS 5.8 | Cisco NX-OS System Software in ACI ModeA vulnerability in the endpoint group (EPG) contract functionality of Cisco Nexus 9000 Series Fabric Switches in ACI Mode could allow an… | |
| CVE-2026-20173 | 7 Oct 2026 | CVSS 5.8 | Cisco NX-OS SoftwareA vulnerability in Cisco NX-OS Software could allow an unauthenticated, remote attacker to exhaust system resources, causing a denial of service… | |
| CVE-2026-106557 | 7 Oct 2026 | CVSS 7.7 | Backstage has improper input validation in TechDocs Markdown extension configurationBackstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package did not… | Fix |
| CVE-2026-106065 | 7 Oct 2026 | CVSS 6.3 | Red Hat Enterprise Linux 10A heap-based buffer overflow was found in GIMP’s PCX export plug-in. For images with extremely large width and height, buffer allocation uses… | |
| CVE-2026-101886 | 7 Oct 2026 | CVSS 4.0 | Cisco Jabber for AndroidCisco Jabber for Android (com.cisco.im) before 15.3.1.311364 contains a path traversal vulnerability that allows a malicious app with no permissions… | |
| CVE-2026-92415 | 7 Oct 2026 | CVSS 5.3 | Apache Software Foundation Apache Jackrabbit— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx… | |
| CVE-2026-92414 | 7 Oct 2026 | CVSS 9.1 | Apache Software Foundation Apache Jackrabbit: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session… | |
| CVE-2026-107273 | 7 Oct 2026 | CVSS 4.3 | gophishGophish 0.11.0 through 0.12.1 contains a server-side request forgery vulnerability that allows authenticated low-privileged users to reach loopback… | |
| CVE-2026-107276 | 7 Oct 2026 | CVSS 6.3 | MISPMISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests carrying the same valid OTP are… | |
| CVE-2026-107278 | 7 Oct 2026 | CVSS 5.3 | MISPMISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on… | |
| CVE-2026-33586 | 7 Oct 2026 | CVSS 6.3 | OVHcloudAuthenticated users are able to manipulate both the SMTP envelope “Envelope-from” and “From” fields when sending emails through OVH mail servers. Due… | |
| CVE-2026-107210 | 7 Oct 2026 | CVSS 5.3 | ImageMagickImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted highly… | Fix |
| CVE-2026-107269 | 7 Oct 2026 | CVSS 3.7 | gophishGophish through 0.12.1 contains a timing discrepancy vulnerability in AdminServer.Login that allows unauthenticated attackers to enumerate valid… | |
| CVE-2026-107270 | 7 Oct 2026 | CVSS 7.1 | gophishGophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups… | |
| CVE-2026-107271 | 7 Oct 2026 | CVSS 5.3 | gophishGophish through 0.12.1 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade /login throttling by spoofing… | |
| CVE-2026-107272 | 7 Oct 2026 | CVSS 4.7 | gophishGophish through 0.12.1 contains stored and reflected cross-site scripting vulnerabilities that allow attackers to inject script by returning… | |
| CVE-2026-107204 | 7 Oct 2026 | CVSS 9.8 | LMCacheLMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by posting… | |
| CVE-2026-107205 | 7 Oct 2026 | CVSS 8.6 | LMCacheLMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers to… | |
| CVE-2026-107206 | 7 Oct 2026 | CVSS 9.4 | LMCacheLMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticated… | |
| CVE-2026-107207 | 7 Oct 2026 | CVSS 7.2 | LMCacheLMCache through 0.5.5 contains a server-side request forgery vulnerability in its frontend monitoring service that allows unauthenticated attackers… | |
| CVE-2026-107208 | 7 Oct 2026 | CVSS 5.3 | ImageMagickImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted XMP profile… | Fix |
| CVE-2026-107209 | 7 Oct 2026 | CVSS 7.5 | ImageMagickImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, when ImageMagick is… | Fix |
| CVE-2026-106577 | 7 Oct 2026 | CVSS 6.5 | ImageMagickImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, unescaped or… | Fix |
| CVE-2026-106578 | 7 Oct 2026 | CVSS 7.5 | ImageMagickImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can… | Fix |
| CVE-2026-106579 | 7 Oct 2026 | CVSS 7.5 | ImageMagickImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can… | Fix |
| CVE-2026-106580 | 7 Oct 2026 | CVSS 8.2 | ImageMagickImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing… | Fix |
| CVE-2026-107166 | 7 Oct 2026 | CVSS 5.3 | Open5GSA weakness has been identified in Open5GS up to 2.7.7. This vulnerability affects the function ogs_pfcp_xact_local_create of the file… | |
| CVE-2026-106572 | 7 Oct 2026 | CVSS 5.3 | ImageMagickImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a missing… | Fix |
| CVE-2026-106573 | 7 Oct 2026 | CVSS 7.5 | ImageMagickImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing limit check… | Fix |
| CVE-2026-106574 | 7 Oct 2026 | CVSS 6.5 | ImageMagickImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a client connected to the… | Fix |
| CVE-2026-106575 | 7 Oct 2026 | CVSS 5.3 | ImageMagickImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause… | Fix |
| CVE-2026-106576 | 7 Oct 2026 | CVSS 7.5 | ImageMagickImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted XMP profile can trigger… | Fix |
| CVE-2026-106569 | 7 Oct 2026 | CVSS 5.3 | ImageMagickImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, missing validation and resource… | Fix |
| CVE-2026-106570 | 7 Oct 2026 | CVSS 6.5 | ImageMagickImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, an unauthenticated adjacent-network… | Fix |
| CVE-2026-106571 | 7 Oct 2026 | CVSS 5.5 | ImageMagickImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 6.9.13-56 and 7.1.2-31, a crafted local call… | Fix |
| CVE-2026-106568 | 7 Oct 2026 | CVSS 5.3 | ImageMagickImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted XMP profile… | Fix |
| CVE-2026-106564 | 7 Oct 2026 | CVSS 5.3 | ImageMagickImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, a crafted EXR image can cause the… | Fix |
| CVE-2026-106565 | 7 Oct 2026 | CVSS 7.5 | ImageMagickImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file… | Fix |
| CVE-2026-106566 | 7 Oct 2026 | CVSS 4.4 | ImageMagickImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, delegate symlink cleanup does not… | Fix |
| CVE-2026-106567 | 7 Oct 2026 | CVSS 7.5 | ImageMagickImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted PSD file… | Fix |
| CVE-2026-77214 | 7 Oct 2026 | CVSS 8.2 | libexpatlibexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with… | |
| CVE-2026-62179 | 7 Oct 2026 | CVSS 6.5 | PraisonAI: Platform members can delete owner issue dependencies through member-owned related issuesPraisonAI is a multi-agent teams system. In `praisonai-platform` prior to version 0.1.9, issue dependency deletion can be authorized against the… | Fix |
| CVE-2026-46570 | 7 Oct 2026 | CVSS 8.1 | Tuxera ntfs-3gIn NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_index_walk_down() in libntfs-3g/index.c that allows an attacker to corrupt heap… | Fix |
| CVE-2026-107202 | 7 Oct 2026 | CVSS 9.1 | jonssonyan h-uiA command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API due to improper validation of the listen… | |
| CVE-2026-107169 | 7 Oct 2026 | CVSS 6.2 | Red Hat Enterprise Linux 10A flaw was found in m17n-lib. An attacker could provide specially crafted or truncated UTF-8 input to trigger an unhandled null pointer dereference… | |
| CVE-2026-107174 | 7 Oct 2026 | CVSS 6.4 | Red Hat OpenShift ServerlessA flaw was found in source-to-image. When unpacking archive files, the application fails to properly sanitize symbolic links pointing to absolute… | |
| CVE-2026-107125 | 7 Oct 2026 | CVSS 6.3 | XnView ClassicA flaw has been found in XnView Classic 2.52.5. Impacted is an unknown function of the component FLI File Parser. This manipulation of the argument… | |
| CVE-2026-107167 | 7 Oct 2026 | CVSS 6.2 | Red Hat Enterprise Linux 10A flaw was found in m17n-lib. A user providing specially crafted text input can trigger a heap use-after-free condition during input-method state… | |
| CVE-2026-106559 | 7 Oct 2026 | CVSS 6.5 | Backstage: Improper input validation in Confluence to Markdown scaffolder moduleBackstage is an open framework for building developer portals. Prior to 0.3.25, the… | Fix |
| CVE-2026-106560 | 7 Oct 2026 | CVSS 6.5 | Backstage: Improper repository path validation in a Scaffolder backend moduleBackstage is an open framework for building developer portals. Prior to 0.3.25, the… | Fix |
| CVE-2026-106561 | 7 Oct 2026 | CVSS 5.0 | Backstage has a sensitive information disclosure in Kubernetes resource queriesBackstage is an open framework for building developer portals. Prior to 0.21.9, the @backstage/plugin-kubernetes-backend package is affected by… | Fix |
| CVE-2026-106562 | 7 Oct 2026 | CVSS 4.3 | Backstage has incorrect authorization in search engine permission filteringBackstage is an open framework for building developer portals. Prior to 2.1.6 in @backstage/plugin-search-backend and 1.8.7 in… | Fix |
| CVE-2026-106563 | 7 Oct 2026 | CVSS 6.5 | Backstage: Improper entity validation in deprecated Kubernetes services endpointBackstage is an open framework for building developer portals. Prior to 0.21.8, the @backstage/plugin-kubernetes-backend package is affected by… | Fix |
| CVE-2026-106558 | 7 Oct 2026 | CVSS 8.8 | Backstage: Improper validation of TechDocs MkDocs configurationBackstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package… | Fix |
| CVE-2026-106510 | 7 Oct 2026 | CVSS 7.7 | Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.ymlBackstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote… | Fix |
| CVE-2026-106556 | 7 Oct 2026 | CVSS 7.7 | backstageBackstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by… | Fix |
| CVE-2026-106064 | 7 Oct 2026 | CVSS 6.3 | Red Hat Enterprise Linux 10A heap-based buffer overflow was found in GIMP’s GIF export plug-in. Exporting an image with very large width and height can cause 32-bit overflow… | |
| CVE-2026-104074 | 7 Oct 2026 | CVSS 5.3 | coturnCoturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents by… | |
| CVE-2025-70521 | 7 Oct 2026 | CVSS 9.8 | VulnerabilityThe management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of… | |
| CVE-2025-70522 | 7 Oct 2026 | CVSS 8.8 | VulnerabilityThe request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin resource protection for any state-changing request… | |
| CVE-2025-70520 | 7 Oct 2026 | CVSS 9.8 | VulnerabilityThe websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The… | |
| CVE-2025-70518 | 7 Oct 2026 | CVSS 10.0 | VulnerabilityThe management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of… | |
| CVE-2025-70519 | 7 Oct 2026 | CVSS 6.1 | VulnerabilityThe device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of… | |
| CVE-2025-70516 | 7 Oct 2026 | CVSS 9.1 | VulnerabilityThe websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The… | |
| CVE-2025-70517 | 7 Oct 2026 | CVSS 8.8 | VulnerabilityThe request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin resource protection for any state-changing request… | |
| CVE-2025-70515 | 7 Oct 2026 | CVSS 6.1 | VulnerabilityThe device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of… | |
| CVE-2026-46572 | 7 Oct 2026 | CVSS 7.4 | Tuxera ntfs-3gIn NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_cut_tail() in libntfs-3g/index.c that allows an attacker to corrupt heap memory… | Fix |
| CVE-2026-88514 | 7 Oct 2026 | CVSS 5.5 | VulnerabilityAn issue in iTerm2 macOS before 3.6.12 allows a local attacker to obtain sensitive information. | |
| CVE-2026-45161 | 7 Oct 2026 | CVSS 5.4 | wger: trainer_login accepts GET - CSRF bypass enables forced session rebindingwger is a free, open-source workout and fitness manager. Prior to version 2.6, the `trainer_login` view in wger accepts GET requests and executes… | |
| CVE-2026-46434 | 7 Oct 2026 | CVSS 7.1 | wger: Trainer Privilege Escalation - Improper Privilege Managementwger is a free, open-source workout and fitness manager. Prior to version 2.6, a user with only the `gym_trainer` permission can deactivate any… | |
| CVE-2026-46437 | 7 Oct 2026 | CVSS 4.8 | wger: API credentials remain valid after logout/password changewger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the authentication/session lifecycle of `wger`… | |
| CVE-2026-46438 | 7 Oct 2026 | CVSS 6.5 | wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entrywger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries… |
Page 105 of 168