1924334 matches found
EUVD-2026-95208
Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash that allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypted PDFs. Attackers can supply a password longer than 127 bytes through applications using the...
EUVD-2026-95209
Dolibarr ERP CRM before 24.0.2 contains an incorrect authorization vulnerability in htdocs/core/ajax/updateextrafield.php that checks only read permission before writing extrafield values. Authenticated users with read-only access can POST objectType, objectId, field and value parameters to...
EUVD-2026-95251
TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentication vulnerability that allows remote unauthenticated attackers to read sensitive device information and modify device configuration via unprotected REST API endpoints on port 8288. Attackers...
EUVD-2026-95157
Docker Sandboxes could fail open while masking credentials in protected proxy responses. When a response-body read returned data together with an error, affected handlers could forward unmasked bytes. Code inside an authorized sandbox could use this to recover host-managed OAuth access and refres...
CVE-2026-107716
The Banks library, used for generating LLM prompts, contains a symlink traversal vulnerability in the DirectoryPromptRegistry component prior to version 2.5.1 . The root cause is that the registry fails to reject symbolic links for index.json or .jinja prompt files. If an attacker can influence t...
CVE-2026-107716 Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry
Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.1, Banks DirectoryPromptRegistry does not reject symbolic links for index.json or discovered and existing .jinja prompt files. In an application where untrusted users can influence a prompt directory,...
EUVD-2026-95340
Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.1, Banks DirectoryPromptRegistry does not reject symbolic links for index.json or discovered and existing .jinja prompt files. In an application where untrusted users can influence a prompt directory,...
Security Bulletin: IBM Planning Analytics Local is affected by security vulnerabilities
Summary The Planning Analytics Workspace component of IBM Planning Analytics is affected by security vulnerabilities. These vulnerabilities have been addressed in IBM Planning Analytics Local v2.0 - IBM Planning Analytics Workspace version 2.1.24. Vulnerability Details CVEID:CVE-2026-75063...
CVE-2026-107778
MIT Kerberos 5 krb5 through 1.22.2 contains a NULL pointer dereference in makecredlist in rdcred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticketinfo entries through...
CVE-2026-107318
@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP or HTTPS server. In versions prior to 12.7.0, all of the built-in HTTPS transports override the secure default and set rejectUnauthorized to false, so the proxy does not verify the TLS certificate of the upstream...
CVE-2026-107397
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can create content, including speakers who can create minutes, can store crafted HTML in event minutes. When concurrent edits are made to the same minutes, t...
CVE-2026-106435
The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...
GHSA-V6C2-XWV6-8XF7
creationtimestamp| type| source ---|---|--- 2026-10-08 21:03:11+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mxfebmv3qv2s...
CVE-2026-84275
creationtimestamp| type| source ---|---|--- 2026-10-08 21:01:05+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mxfe5ua7vn2s...
CVE-2026-107780
creationtimestamp| type| source ---|---|--- 2026-10-08 21:00:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mxfe43epqz2o...
Exploit for CVE-2026-91940
CVE-2026-91940: arbitrary file write in crawl4ai through the u...
Exploit for CVE-2020-11651
SaltStack Master Authentication Bypass CVE-2020-11651 Vulh...
GHSA-R223-96JV-Q533
creationtimestamp| type| source ---|---|--- 2026-10-08 20:52:41+00:00| seen| https://bsky.app/profile/standup.thecompound.tech/post/3mxfdou2rw32p...