33296 matches found
pymongo: MongoDB Python Driver: Data disclosure and denial of service via query-operator injection
A flaw was found in the GridFS component of the MongoDB Python Driver pymongo. The driver can treat a caller-supplied structured file identifier as a MongoDB query condition instead of a literal identifier. An authenticated user who can influence the identifier passed to GridFS download, delete, ...
CVE-2026-73796
A security vulnerability in HPE NonStop TSQLEXE may cause application crash via a crafted SQL query...
CVE-2026-73796 HPE NonStop TSQLEXE - Memory Corruption vulnerability
A security vulnerability in HPE NonStop TSQLEXE may cause application crash via a crafted SQL query...
EUVD-2026-100991
A security vulnerability in HPE NonStop TSQLEXE may cause application crash via a crafted SQL query...
CVE-2026-73796
A security vulnerability exists in HPE NonStop TSQLEXE (specifically version T9193L01^AIP and earlier, and T9193L02 ) that may result in an application crash when processing a crafted SQL query . This vulnerability is characterized as a memory corruption issue and can lead to Denial of Service (D...
CVE-2026-73796 HPE NonStop TSQLEXE - Memory Corruption vulnerability
A security vulnerability in HPE NonStop TSQLEXE may cause application crash via a crafted SQL query...
Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Struts
Summary Multiple vulnerabilities were addressed in IBM Library Support for Struts 1.0 Vulnerability Details CVEID:CVE-2005-3745 DESCRIPTION: Cross-site scripting XSS vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML vi...
BIT-ELASTICSEARCH-2026-102404 Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service
Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130. A low-privileged authenticated user can submit a specially crafted query that causes uncontrolled memory growth in the query processing engine, resulting in an out-of-memor...
github.com/getkin/kin-openapi: kin-openapi: Denial of Service via nil-pointer dereference in request decoding
A flaw was found in kin-openapi. An unauthenticated remote attacker can cause a Denial of Service DoS by sending specially crafted HTTP requests containing specific array query parameters or form-encoded data. Because the request decoder fails to properly validate certain array schemas before...
github.com/getkin/kin-openapi: kin-openapi: Denial of Service via redundant regular expression compilation in query parameter decoding
A flaw was found in kin-openapi. An unauthenticated remote attacker can trigger a Denial of Service DoS by sending requests containing a large number of query parameters to an affected endpoint. Due to redundant regular expression compilation within the parameter decoding loop, processing these...
ALSA-2026:82858 Important: python36:3.6 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...
PT-2026-113636
The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.5 via the 'Last referrers' meta box on the plugin's Overview admin page. This is due to insufficient output escaping of the visitor-supplied query string that the plugin record...
RHEL 8 : python36:3.6 (RHSA-2026:82858)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:82858 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...
Important: python36:3.6 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...
Unity Linux 20.1070a Security Update: grafana (UTSA-2026-130092)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130092 advisory. The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by...
PT-2026-113611
The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'QUERY STRING / REQUEST URI' parameter in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
PT-2026-113762
šØ CVE-2026-0313 A command injection vulnerability in Palo Alto Networks Cortex XSOAR and Cortex XSIAM OS Query content pack enables an authenticated administrator to execute arbitrary OS commands on remote endpoints. š@cveNotify...
PT-2026-113864
Name of the Vulnerable Software and Affected Versions Junos OS Evolved affected versions not specified Description A reachable assertion issue in the fwstatsd process allows an authenticated network attacker to cause a denial of service. This occurs when an SNMP query is sent to the...
CVE-2026-100406: Improper Limitation of a Pathname to a Restricted Directory
dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. From 2.0.0-alpha.0 until 2.0.0-alpha.5, dbt docs serve exposes the unauthenticated POST /api/v1/query endpoint in crates/dbt-docs-server/src/handlers/query.r...
RockyLinux 8 : python36:3.6 (RLSA-2026:82858)
The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:82858 advisory. pymongo: MongoDB Python Driver: Data disclosure and denial of service via query-operator injection CVE-2026-88029 Tenable has extracted the preceding description...