| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Deserialization of Untrusted Data vulnerability in Strongholdthemes Dental Care CPT dentalcare-cpt allows Object Injection.This issue affects Dental Care CPT: from n/a before 21.6. |
| An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component. NOTE: the Supplier disputes the relevance of this report because the site administrator is a trusted party, and would not plausibly set main_url to a URL that offers additional information to an adversary. |
| Webasyst Framework through 4.4.0 contains a stored cross-site scripting vulnerability in the Photos app that allows authenticated backend users to inject JavaScript via the album url parameter. Attackers with album edit rights can save a url value that breaks out of the unescaped attribute in DialogAlbumSettings.html, executing JavaScript in administrators' backend sessions. |
| A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01. This affects an unknown part of the file /admin-api/system/tenant/get-by-website. The manipulation of the argument Website results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as bccf7c79e5f93f027a021172a18e8876cc6c1062 (master-jdk17). It is advisable to implement a patch to correct this issue. |
| An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions, FortiSandbox PaaS 4.2 all versions may allow attacker to execute unauthorized code or commands via crafted HTTP requests |
| The reported issue is tracked under CVE-2026-18451. This CVE ID is rejected as a duplicate. |
| The reported issue is tracked under CVE-2026-18450. This CVE ID is rejected as a duplicate. |
| The reported issue is tracked under CVE-2026-18449. This CVE ID is rejected as a duplicate. |
| The reported issue was assessed as intended functionality. This CVE ID is unused by the CNA. |
| The reported issue was assessed as intended functionality. This CVE ID is unused by the CNA. |
| A vulnerability was determined in DeepSeek Harness up to 0.2.0-rc.2. This issue affects some unknown processing of the file packages/client/connection/src/browser-auth.ts of the component Browser Auth. This manipulation causes improper authorization. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way. |
| The reported issue was assessed as intended functionality. This CVE ID is unused by the CNA. |
| The reported issue could not be reproduced, and the affected products are end-of-life. This CVE ID is unused by the CNA. |
| The reported issue could not be reproduced. This CVE ID is unused by the CNA. |
| The reported issue could not be reproduced. This CVE ID is unused by the CNA. |
| The reported issue could not be reproduced. This CVE ID is unused by the CNA. |
| Out-of-bounds read in Windows NTFS allows an authorized attacker to execute code locally. |
| A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. This vulnerability affects the function createContext of the file packages/extensions/cordis-host-runner/src/sandbox.ts. The manipulation results in sandbox issue. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way. |
| Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate privileges over a network. |
| Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. |
