1435144 matches found
CVE-2026-110603 LASzip through 3.5.0 Invalid Free via Truncated VLR Header in laszip_read_header
LASzip through 3.5.0 contains an invalid free vulnerability in laszipreadheader that allows attackers to free uninitialized heap pointers via truncated variable length record data. Attackers can supply a crafted LAS/LAZ file with an inflated VLR count that, when opened and destroyed through the C...
CVE-2026-110595 BottleCRM 0.45 through 1.14.5 Memory Exhaustion via Contact and Case CSV Import
BottleCRM 0.45 through 1.14.5 contains an uncontrolled memory allocation vulnerability in readupload that reads entire CSV uploads before enforcing the 5 MB limit. Authenticated users with mass-import permission can send oversized CSV files concurrently to /api/contacts/import/ and...
CVE-2026-110595 BottleCRM 0.45 through 1.14.5 Memory Exhaustion via Contact and Case CSV Import
BottleCRM 0.45 through 1.14.5 contains an uncontrolled memory allocation vulnerability in readupload that reads entire CSV uploads before enforcing the 5 MB limit. Authenticated users with mass-import permission can send oversized CSV files concurrently to /api/contacts/import/ and...
CVE-2026-110593 BottleCRM through 1.14.5 Server-Side Template Injection via Account Email create_mail
BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the sendemail Celery task, which compiles the user-supplied AccountEmail messagebody with django.template.Template. Authenticated organization members can submit template tags through POST /api/accounts//createmai...
CVE-2026-110593 BottleCRM through 1.14.5 Server-Side Template Injection via Account Email create_mail
BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the sendemail Celery task, which compiles the user-supplied AccountEmail messagebody with django.template.Template. Authenticated organization members can submit template tags through POST /api/accounts//createmai...
CVE-2025-71433 Kaneo before 2.1.6 Missing Authorization Allows Cross-Workspace Data Access
Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label or workspace identifiers to API routes lacking membership checks. Attackers who obtain identifiers, for example from shared project links,...
CVE-2025-71433 Kaneo before 2.1.6 Missing Authorization Allows Cross-Workspace Data Access
Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label or workspace identifiers to API routes lacking membership checks. Attackers who obtain identifiers, for example from shared project links,...
CVE-2020-37281 Gravitee API Management through 4.12.22 Default JWT Secret Authentication Bypass
Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can sign an HS256 token with that subject...
CVE-2020-37281 Gravitee API Management through 4.12.22 Default JWT Secret Authentication Bypass
Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can sign an HS256 token with that subject...
CVE-2026-63171
creationtimestamp| type| source ---|---|--- 2026-10-14 14:16:15+00:00| seen| https://infosec.exchange/users/cve/statuses/117439684607947759...
CVE-2026-63169
creationtimestamp| type| source ---|---|--- 2026-10-14 14:15:34+00:00| seen| https://infosec.exchange/users/cve/statuses/117439681947029369...
CVE-2026-63168
creationtimestamp| type| source ---|---|--- 2026-10-14 14:14:54+00:00| seen| https://infosec.exchange/users/cve/statuses/117439679282665914...
CVE-2026-63157
creationtimestamp| type| source ---|---|--- 2026-10-14 14:14:13+00:00| seen| https://infosec.exchange/users/cve/statuses/117439676641004319...
CVE-2026-63156
creationtimestamp| type| source ---|---|--- 2026-10-14 14:13:33+00:00| seen| https://infosec.exchange/users/cve/statuses/117439673978948535...
CVE-2026-34634
creationtimestamp| type| source ---|---|--- 2026-10-14 14:12:12+00:00| seen| https://infosec.exchange/users/cve/statuses/117439668667825665...
CVE-2026-19810
creationtimestamp| type| source ---|---|--- 2026-10-14 14:11:31+00:00| seen| https://infosec.exchange/users/cve/statuses/117439666022366321...
CVE-2026-14909
creationtimestamp| type| source ---|---|--- 2026-10-14 14:10:51+00:00| seen| https://infosec.exchange/users/cve/statuses/117439663381678426...
CVE-2026-14532
creationtimestamp| type| source ---|---|--- 2026-10-14 14:10:13+00:00| seen| https://infosec.exchange/users/cve/statuses/117439660737320059...