Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the asyncgetmediaimage function in the Shelly integration when processing the thumb field. An attacker can execute arbitrary HTML or JavaScript in the context of the Home Assistant web origin by supplying a...

CVE-2026-44907

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack versions 19.0.0...

glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings

A flaw was found in glibc GNU C Library. When the ungetwc function is called on a file stream using wide characters with specific overlapping single-byte and multi-byte encodings, it may attempt to read data outside of its allocated buffer. This can lead to the unintentional disclosure of sensiti...

CVE-2026-46681

@nevware21/ts-utils is a comprehensive TypeScript/JavaScript utility library. Prior to version 0.14.0, the copyProps function in lib/src/object/copy.ts uses for...in to iterate over source object properties without an Object.hasOwnProperty check, and does not filter dangerous keys proto,...

EUVD-2026-46265

A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The affected element is the function...

glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings

A flaw was found in glibc GNU C Library. When the ungetwc function is called on a file stream using wide characters with specific overlapping single-byte and multi-byte encodings, it may attempt to read data outside of its allocated buffer. This can lead to the unintentional disclosure of sensiti...

SUSE CVE-2026-54369

acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions aclgetfile, aclsetfile, aclextendedfile, and acldeletedeffile that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who contr...

SUSE CVE-2026-64042

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Check BAR resources before exporting a DMABUF A DMABUF exports access to BAR resources and, although they are requested at startup time, we need to ensure they really were reserved before exporting. Otherwise, it's...

A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.

...

A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.

...

postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory

A flaw was found in PostgreSQL libpq. A server superuser can exploit a buffer overflow vulnerability in the PQfn function, which is used by client functions such as loexport, loread, lolseek64, and lotell64. This allows the superuser to send an arbitrarily large response, overwriting the client's...

CVE-2026-16266

Versions of the package mongo-object before 3.0.3 are vulnerable to Prototype Pollution via the expandKey function in util.js. An attacker can modify the JavaScript prototype chain by supplying a crafted property path containing special keys such as proto...

CVE-2026-16266

Versions of the package mongo-object before 3.0.3 are vulnerable to Prototype Pollution via the expandKey function in util.js. An attacker can modify the JavaScript prototype chain by supplying a crafted property path containing special keys such as proto...

CVE-2026-16266

Versions of the package mongo-object before 3.0.3 are vulnerable to Prototype Pollution via the expandKey function in util.js. An attacker can modify the JavaScript prototype chain by supplying a crafted property path containing special keys such as proto...

CVE-2026-16331

A security vulnerability has been detected in D-Link DNS-320 1.0.2. This affects an unknown function of the file /web/function/saveajax.php. Such manipulation of the argument Malicious Handler leads to unrestricted upload. The attack can be executed remotely. The exploit has been disclosed public...

EUVD-2026-46115

A vulnerability was identified in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. The impacted element is an unknown function of the file /business/qnaire/upload.jsp. Such manipulation of the argument File leads to unrestricted upload. The attack may be launched remotely. The exploit is publicly...

ROS-20260721-73-0024

The vulnerability of the Navigation function in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to bypass the sandboxing protection mechanisms...

ROS-20260721-73-0016

The vulnerability of the Navigation function in Google Chrome and Microsoft Edge is related to a breach of data protection mechanisms. Exploiting this vulnerability allows an attacker to bypass existing security measures through a specially created HTML page...

ROS-20260721-73-0013

The vulnerability of the Navigation function in Google Chrome and Microsoft Edge is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to bypass the sandboxing protection mechanisms...

PT-2026-63293

Name of the Vulnerable Software and Affected Versions Gitea versions 1.22.x and earlier Description A Local File Inclusion issue exists in the restore-repo command when processing release.yml files from user-supplied archives. The DownloadURL field in release attachments is passed to the uri.Open...