HSC MailInspector v5.3.3-7 contains a Cross-Site Scripting (XSS) vulnerability in the /tap/tap.php endpoint due to improper neutralization of user-controlled input using alternate or obfuscated JavaScript syntax. The endpoint reflects unsanitized user input in HTTP responses without adequate output ...
HSC MailInspector 5.3.3-7 has a Path Traversal vulnerability due to improper validation of user-supplied input in the /tap/dw.php endpoint. The text parameter is used to construct file paths without adequate normalization or restriction to a safe base directory. A remote attacker can exploit this fl...
HSC MailInspector v5.3.3-7 contains a Local File Inclusion (LFI) vulnerability caused by improper control of user-supplied file paths. The endpoint /vendor/phpunit/phpunit.php processes user-controlled parameters that directly affect file access operations without adequate validation, sanitization, ...
Incorrect access control in the /uci/get/ endpoint of NOVUS AirGate 4G firmware v1.1.16 allows unauthenticated attackers to obtain administrator credentials via a crafted POST request.
OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads
OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messages
OpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agent
ImageMagick: Policy Bypass in PSD decoder
Docker: Race condition in docker cp allows bind mount redirection to host path
Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap
CloakBrowser: Unauthenticated path traversal via fingerprint parameter in cloakserve leads to arbitrary directory deletion
ImageMagick: Out-of-Bounds Read of a single byte in meta encoder
ImageMagick: Out-of-Bounds Read in connected components when the user supplies an invalid keep-top define
Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API
Docker: `PUT /containers/{id}/archive` executes container binary on the host
Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope Rows
Budibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Without SMTP Configuration
n8n-MCP: Multi-tenant MCP requests fall back to process-level n8n credentials when tenant headers are absent or incomplete
Sulu: Weak Cryptographical usage for API Key generation and Reset Tokens
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351