261625 matches found
Logging operator has Fluentd configuration injection that allows remote code execution
Summary The Fluentd configuration renderer in Logging operator writes strings from CRDs such as Flow directly into fluent.conf without escaping them. As a result, a user who can create Flow resources can inject Fluentd configuration by providing values that contain newlines. In the confirmed path...
GHSA-MJQF-28PH-426H Logging operator has Fluentd configuration injection that allows remote code execution
Summary The Fluentd configuration renderer in Logging operator writes strings from CRDs such as Flow directly into fluent.conf without escaping them. As a result, a user who can create Flow resources can inject Fluentd configuration by providing values that contain newlines. In the confirmed path...
CVE-2026-16729
undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields. In undici
CVE-2026-54662
creationtimestamp| type| source ---|---|--- 2026-07-29 16:35:22+00:00| published-proof-of-concept| https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-hqj5-cw9f-rx67 2026-07-29 18:42:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrsld7nukl24...
CVE-2026-64559
In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in PKEYVERIFYPROTK ioctl Explicitly check the buffer length request structure provided by user-space and fail, if it exceeds the buffer size...
CVE-2026-60113
AMMOS Instrument Toolkit AIT Deep Space Network DSN Interface before 2.2.2 contains a missing authentication vulnerability in the Space Link Extension SLE interface manager that allows unauthenticated network attackers to access seven unprotected API routes by sending direct HTTP requests with no...
CVE-2026-60112
AMMOS Instrument Toolkit (AIT) GUI before 2.5.1 has a missing authentication flaw in Sessions.create(), enabling an unauthenticated network attacker to obtain a valid session and issue arbitrary spacecraft commands. After session issuance, handle_cmd() can forward commands to the AIT command bus ...
CVE-2026-60112
AMMOS Instrument Toolkit AIT GUI before 2.5.1 contains a missing authentication vulnerability that allows any unauthenticated network attacker to obtain a valid session and issue arbitrary spacecraft commands by calling Sessions.create without any credential check. Attackers can exploit the...
CVE-2026-17550
CVE-2026-17550 describes an out-of-bounds read vulnerability in Autodesk AutoCAD when parsing malicious DWG/DXF files. The issue affects the DWG/DXF parsing component and can cause a crash or disclosure of sensitive information. According to the provided metrics, the CVSSv3.1 base score is 5.5 (M...
CVE-2026-16463 DXF File Parsing Heap-Based Overflow in Autodesk AutoCAD
A maliciously crafted DXF file, when parsed through Autodesk AutoCAD, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process...
GHSA-4CWX-7WF7-3272
creationtimestamp| type| source ---|---|--- 2026-07-29 15:21:07+00:00| seen| https://bsky.app/profile/nodeland.dev/post/3mrsa2kt7jx23 2026-08-03 19:25:00+00:00| seen| https://bsky.app/profile/thestandup.bsky.social/post/3ms77zcaiyk2n...
EUVD-2026-50372
veraPDF PDF parser is a PDF parser for veraPDF. Prior to 1.30.2 and 1.31.23, veraPDF-parser contains a denial-of-service vulnerability in veraPDF-parser/src/main/java/org/verapdf/pd/font/type1/Type1FontProgram.java and veraPDF-parser/src/main/java/org/verapdf/parser/postscript/PSOperator.java,...
EUVD-2026-50371
veraPDF PDF parser is a PDF parser for veraPDF. Prior to 1.30.2 and 1.31.23, veraPDF-parser contains a denial-of-service vulnerability in veraPDF-parser/src/main/java/org/verapdf/pd/font/cmap/CMapParser.java and veraPDF-parser/src/main/java/org/verapdf/parser/postscript/PSOperator.java, where a...
CVE-2026-54666
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-routes/schema-routes.ts passes OpenAPI path keys through parseRouteName to templates/default/procedure-call.ejs and templates/modular/procedure-call.ejs without escaping...
EUVD-2026-50370
veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity vulnerability in PDFAValidator.validate... and GFPDAcroForm.getdynamicRender, where default DocumentBuilderFactory parsing of...
CVE-2026-67215
creationtimestamp| type| source ---|---|--- 2026-07-29 15:00:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrs6wfpmo72f 2026-07-29 15:40:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrsb4uh6gh2q 2026-08-05 18:07:07+00:00| seen|...
io.netty/netty-codec-http: Netty: Protocol version confusion in netty-codec-http (WebSocket)
A flaw was found in netty-codec-http. The WebSocket handshaker in this component fails to properly validate protocol version information during the WebSocket upgrade process. A remote attacker can exploit this vulnerability by manipulating the WebSocket handshake, leading to a bypass of security...
ROOT-APP-MAVEN-CVE-2026-22751 CVE-2026-22751 in io.root.org.springframework.security:spring-security-core - Patched by Root
Root has patched CVE-2026-22751 in the io.root.org.springframework.security:spring-security-core package for Root:Maven. Multiple fixed versions available...
swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies
Summary swagger-typescript-api interpolates OpenAPI path strings the keys of the paths object, e.g. /users/id directly into a JavaScript template literal inside the body of every generated API method, without escaping. A spec path containing $ … survives parseRouteName's x / :x rewriter verbatim...
CVE-2026-65889
creationtimestamp| type| source ---|---|--- 2026-07-29 14:34:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrs5ghjoz22s 2026-07-29 14:53:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrs6j74a6u2i 2026-08-06 08:07:06+00:00| seen|...