آخرین آسیب‌پذیری‌ها

Git for Windows: git-credential-wincred OAuth Store Heap Overflow

Oqtane Framework before 10.3.0 SSRF via File Upload From URL

Oqtane Framework before 10.3.0 Broken Access Control via SettingController

WatchGuard AuthPoint Gateway Improper HMAC Validation in LDAP Authentication Callback Allows Forged Authentication Results

WatchGuard AuthPoint Gateway Improper Authentication Allows Unauthenticated Denial of Service

WatchGuard AuthPoint Gateway Improper Certificate Validation Allows Man-in-the-Middle Attacks

WatchGuard AuthPoint Gateway Capture-replay Allows Unauthorized Administrative Actions

SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func

SQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile

SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl allow SQL injection via the where values of a nested statement in an identifier position

Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output

Data::MuForm versions through 0.05 for Perl render attribute values and option labels into HTML without escaping

frr: ospf6d fails to enforce all OSPFv3 packets use IPv6 link-local addresses

The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs whe…

Sender WordPress Plugin < 2.11.3 Broken Access Control via admin_post_sender_debug_download

Unbounded query cache growth from interpolated JSON paths and splice lists in Ecto

wePOS before 2.0.3 Missing Authorization via payment/process Endpoint

Pay with Vipps and MobilePay for WooCommerce before 6.4.1 Webhook Signature Forgery

Symfony: HtmlSanitizer MetaRefreshAttributeSanitizer Matches Only a Narrow Subset of the Browser Refresh Grammar (Incomplete Fix for CVE-2026-48761)

Security Misconfiguration Vulnerability in Tata Motors iRA and iRA.ev mobile application

Information Disclosure Vulnerability in Tata Motors iRA and iRA.ev mobile application

CoopCycle coopcycle-web 5.6.0 before 6.20.0 Missing Zelty Webhook Signature Verification

Insecure Configuration Vulnerability in Tata Motors iRA and iRA.ev mobile application

Symfony: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Control

zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 CRLF Header Injection via Message Builders