Secur0

Latest CVEs · RSS

• CVE-2026-104024 2026-10-15 · CVSS 4.6
  Incomplete List of Disallowed Inputs (CWE-184) in the dangerous-extension confirmation of the archive object viewer (peach.pas, grid_obj_open) in PeaZip 10.5.0
• CVE-2026-104025 2026-10-15 · CVSS 8.4
  Path Traversal (CWE-22) in the execute_obj function of the archive object viewer (peach.pas) in PeaZip 11.2.0 and earlier on Windows allows an attacker who conv
• CVE-2026-100169 2026-10-14 · CVSS 7.6
  Improper Authentication in the social account linking path of the Prowler API in Prowler from 5.4.0 before 5.35.0 allows a remote unauthenticated attacker to ob
• CVE-2026-102514 2026-10-01 · CVSS 8.4
  Out-of-bounds Write (CWE-787) in the PEA archive extraction routine (pea.pas, unpea_procedure) of the first-party pea component in PeaZip 11.2.0 and earlier all
• CVE-2026-91154 2026-09-28 · CVSS 6.9
  Missing Authentication for Critical Function (CWE-306) in the product cache revalidation Server Action (src/app/actions.ts, revalidateProducts) in MarcosCamara0
• CVE-2026-95835 2026-09-25 · CVSS 5.6
  Missing Authorization in the askpass escape code handler in kitty from 0.25.0 before 0.49.0 allows a local user other than the one running the terminal to obtai
• CVE-2026-95834 2026-09-25 · CVSS 4.6
  Use After Free in the drag source path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to cause the te
• CVE-2026-80432 2026-09-25 · CVSS 6.0
  Missing Authorization in the drop handling path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to obt
• CVE-2026-80431 2026-09-25 · CVSS 6.8
  Out-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 before 0.49.0 allows a program writing to the terminal to write
• CVE-2026-80430 2026-09-25 · CVSS 4.6
  Improper Link Resolution Before File Access in the drag source staging path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program wr
• CVE-2026-95832 2026-09-25 · CVSS 9.3
  Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49.
• CVE-2026-90896 2026-09-14 · CVSS 8.2
  Missing Authentication for Critical Function (CWE-306) in the checkout session lookup handler (src/app/api/stripe/checkout_sessions/route.ts), exposed at GET /a
• CVE-2026-82911 2026-09-04 · CVSS 5.1
  Cross-Site Request Forgery (CSRF) in the OrderConfirmController at GET /order/confirm/{order_number} in Roskus Prospero Flow CRM before 5.15.11 allows an unauth
• CVE-2026-81931 2026-08-27 · CVSS 4.8
  Unrestricted Upload of File with Dangerous Type in the product photo upload in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated user holding the c
• CVE-2026-78365 2026-08-24 · CVSS 9.3
  Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and m
• CVE-2026-78337 2026-08-24 · CVSS 4.8
  Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the c
• CVE-2026-77780 2026-08-21 · CVSS 5.3
  Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transactio
• CVE-2026-77759 2026-08-21 · CVSS 8.7
  Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero Flow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the
• CVE-2026-76203 2026-08-19 · CVSS 5.1
  Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user
• CVE-2026-75872 2026-08-18 · CVSS 6.9
  HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message c
• CVE-2026-19871 2026-08-14 · CVSS 9.3
  Use of Hard-coded Credentials in the human resources component in Roskus Prospero Flow CRM before 5.15.9 allows unauthenticated remote attackers to authenticate
• CVE-2026-19870 2026-08-14 · CVSS 8.6
  Authorization Bypass Through User-Controlled Key in the payroll module in Roskus Prospero Flow CRM before 5.15.10 allows authenticated users holding the read pa
• CVE-2026-19744 2026-08-13 · CVSS 5.1
  Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application o
• CVE-2026-19734 2026-08-13 · CVSS 8.6
  Missing Authorization and Authorization Bypass Through User-Controlled Key in the product management component in Roskus Prospero Flow CRM before 5.4.7 allows a
• CVE-2026-19716 2026-08-13 · CVSS 5.1
  Stored Cross-site Scripting (CWE-79) in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary J