70686 matches found
PT-2026-83349
Name of the Vulnerable Software and Affected Versions MariaDB Connector/Node.js versions prior to 3.2.4 MariaDB Connector/Node.js versions prior to 3.3.3 MariaDB Connector/Node.js versions prior to 3.4.6 MariaDB Connector/Node.js versions prior to 3.5.3 Description SQL injection is possible when...
PT-2026-83049
Name of the Vulnerable Software and Affected Versions Eclipse Lyo versions 2.0.0 through 7.0.0 Description OAuth server authorization checks can be bypassed when the server supports 2-legged authentication. Applications utilizing the AbstractAdapterCredentialsFilter for authorization filters are...
Linux Distros Unpatched Vulnerability : CVE-2026-81525
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct...
Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: p11-kit (UTSA-2026-032283)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-032283 advisory. An issue was discovered in p11-kit 0.21.1 through 0.23.21. A heap-based buffer over-read has been discovered in the RPC protocol used by thep11-kit server/remote...
Linux Distros Unpatched Vulnerability : CVE-2026-77358
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cpp-httplib is a C++ header-only HTTP/HTTPS library. In versions 0.33.0 through 0.50.0, the TLS-enabled WebSocket client frees the TLS session before closing th...
Devolutions Remote Desktop Manager 2026.1.x < 2026.1.25.0 / 2026.2.x < 2026.2.18.0 Insufficient Data Authenticity Verification (CVE-2026-78417)
The version of Devolutions Remote Desktop Manager installed on the remote host is 2026.1.x prior to 2026.1.25.0 or 2026.2.x prior to 2026.2.18.0. It is, therefore, affected by a vulnerability: - Insufficient verification of data authenticity in the IronVNC client allows an on-path attacker to...
CVE-2026-77358
cpp-httplib is a C++ header-only HTTP/HTTPS library. In versions 0.33.0 through 0.50.0, the TLS-enabled WebSocket client frees the TLS session before closing the WebSocket that still uses it, producing a use-after-free. In WebSocketClient::shutdownandclose the SSL object is freed and the pointer...
CVE-2026-77358 cpp-httplib: Use-after-free of TLS session in WebSocketClient::shutdown_and_close()
cpp-httplib is a C++ header-only HTTP/HTTPS library. In versions 0.33.0 through 0.50.0, the TLS-enabled WebSocket client frees the TLS session before closing the WebSocket that still uses it, producing a use-after-free. In WebSocketClient::shutdownandclose the SSL object is freed and the pointer...
CVE-2026-77358
cpp-httplib , a C++ header-only HTTP/HTTPS library, is affected by a use-after-free vulnerability in its TLS-enabled WebSocket client (versions 0.33.0 through 0.50.0 ). In WebSocketClient::shutdown_and_close(), the SSL object is freed and its pointer cleared before the WebSocket close frame is se...
EUVD-2026-67302
cpp-httplib is a C++ header-only HTTP/HTTPS library. In versions 0.33.0 through 0.50.0, the TLS-enabled WebSocket client frees the TLS session before closing the WebSocket that still uses it, producing a use-after-free. In WebSocketClient::shutdownandclose the SSL object is freed and the pointer...
CVE-2026-76945
CVE-2026-76945 affects the Ebyte NE2-D11 device. The root cause is client-managed authentication tokens without sufficient server-side validation , allowing an attacker to replay or manipulate tokens to gain unauthorized access to administrative functionality . The primary impact is confidentiali...
CVE-2026-76945 Ebyte NE2-D11 Use of Client-Side Authentication
The affected Ebyte device relies on client-managed authentication tokens without sufficient server-side validation. An attacker may replay or manipulate authentication tokens to gain unauthorized access to administrative functionality...
CVE-2026-76945 Ebyte NE2-D11 Use of Client-Side Authentication
The affected Ebyte device relies on client-managed authentication tokens without sufficient server-side validation. An attacker may replay or manipulate authentication tokens to gain unauthorized access to administrative functionality...
fastrepl-client (0.0.1) potentially affected by CVE-2026-37004 via litellm (0.4.4)
litellm PYPI version 0.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - fastrepl-client 0.0.1 Source cves: CVE-2026-37004 Source advisory: OSV:GHSA-6WVF-77M9-58RM...
CVE-2026-71187 Ebyte NA111-M Use of Client-Side Authentication
The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacker may generate valid authentication requests and bypass authentication to obtain administrative access to the device...
CVE-2026-71187
Ebyte NE2-D11 contains a vulnerability in its client-side authentication logic that unauthenticated users can reproduce, allowing an attacker to generate valid authentication requests and bypass authentication entirely to obtain administrative access to the device. The flaw is assessed CRITICAL (...
CVE-2026-71187 Ebyte NA111-M Use of Client-Side Authentication
The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacker may generate valid authentication requests and bypass authentication to obtain administrative access to the device...
CVE-2026-81530
A weakness in the client-side encryption configuration surface of the MongoDB C Driver causes sensitive key-management credential material supplied by the application to be reproduced verbatim in the driver's human-readable diagnostic representation of its client settings, instead of being masked...
CVE-2026-81525
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations...
DEBIAN-CVE-2026-81525
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations...