| CVE-2026-121020 | MÉDIO4.3 | Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) in the security configuration API in AxxonSoft Axxon One before 3.2.0 on Windows and Linux allows a remote authenticated user with limited privileges to enumerate all user accounts and roles configured in the system via the user configuration request, | 03/11/2026 |
| CVE-2026-118448 | MÉDIO6.9 | A use of uninitialized memory vulnerability in the pybddisasm Python bindings affects nd_to_text. If the underlying text conversion fails, including failures caused by invalid parameters, the output buffer may remain uninitialized while still being converted into a Python return value. This may disclose residual proces | 03/11/2026 |
| CVE-2026-118447 | MÉDIO4.8 | A use of uninitialized memory vulnerability in the pybddisasm Python bindings may disclose process memory when instruction decoding fails. The nd_decode, nd_decode_ex, nd_decode_ex2, and nd_decode_with_context functions may return an INSTRUX object whose contents have not been initialized after an unsuccessful decoding | 03/11/2026 |
| CVE-2026-118446 | MÉDIO6.9 | A use-after-free vulnerability in the pybddisasm Python bindings affects array-valued members of INSTRUX objects, including ND_OPERAND arrays. These arrays are exposed as Python lists whose elements reference memory owned by the parent INSTRUX object. Retaining a list or an element does not keep the parent allocation a | 03/11/2026 |
| CVE-2026-118445 | MÉDIO6.9 | A use-after-free vulnerability in the pybddisasm Python bindings affects structure-valued members of INSTRUX objects. These members are exposed through Python objects that reference memory owned by the parent INSTRUX object. A retained reference to a member does not keep the parent allocation alive. Accessing the membe | 03/11/2026 |
| CVE-2026-118444 | MÉDIO4.8 | Out-of-bounds read vulnerabilities in the pybddisasm Python bindings may disclose adjacent process memory during instruction decoding. The nd_decode function may read up to 15 bytes without checking the actual length of the supplied Python buffer. The nd_decode_ex, nd_decode_ex2, and nd_decode_with_context functions pa | 03/11/2026 |
| CVE-2026-115231 | ALTO8.5 | In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager lets a user-mode, memory-protected module post a forged callback request to another module's callback request queue. The receiving module's callback thread calls the function pointer in the request without checking that the Module Manager sent i | 03/11/2026 |
| CVE-2026-113421 | ALTO7.3 | In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, ThreadX Modules does not revoke a module's trace-buffer-full callback when the module is stopped and unloaded. With event tracing enabled and a kernel-owned trace buffer still active, a later buffer wrap invokes the callback from privileged thread context after th | 03/11/2026 |
| CVE-2026-109161 | MÉDIO4.9 | Insufficient bounds checking in the Digital I/O function may allow a remote attacker with high privileges to cause a denial of service. | 03/11/2026 |
| CVE-2026-105982 | ALTO7.2 | Improper input validation in the IPsec VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges. | 03/11/2026 |
| CVE-2026-105981 | ALTO7.2 | Improper input validation in the Digital I/O function may allow a remote attacker with high privileges to inject operating system commands and execute them with root privileges. | 03/11/2026 |
| CVE-2026-105980 | ALTO7.2 | Improper input validation in the WireGuard VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges. | 03/11/2026 |
| CVE-2026-105979 | ALTO7.2 | Improper input validation in the ZeroTier VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges. | 03/11/2026 |
| CVE-2026-105978 | ALTO7.2 | Improper input validation in management control functions may allow a remote attacker with high privileges to inject operating system commands and execute them with root privileges. | 03/11/2026 |
| CVE-2026-103327 | MÉDIO5.3 | The CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 does not verify the authenticity of the payment notifications received by its gateway callback, as the integrity check is skipped while the webhook secret is left at its empty default, allowing unauthenticated attackers to mark arbitrary orders as paid or failed | 03/11/2026 |
| CVE-2026-74846 | — | Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier.
CVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text passwords, crypt hashes and b | 03/11/2026 |
| CVE-2026-4052 | CRÍTICO9.8 | This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint. | 03/11/2026 |
| CVE-2026-16900 | ALTO7.5 | Zohocorp ManageEngine Log360 and EventLog Analyzer versions 13071 and below are vulnerable to an authentication bypass in local collector registration, allowing unauthenticated actor to register a local collector by sending a specially crafted registration request. | 03/11/2026 |
| CVE-2026-13594 | CRÍTICO9.1 | Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product. | 03/11/2026 |
| CVE-2026-120988 | MÉDIO6.1 | billboard.js before 4.1.3 allows an attacker to execute malicious JavaScript due to improper sanitization of series ids during legend template rendering. | 03/11/2026 |