301154 matches found
CVE-2026-64893
Cleartext Transmission of Sensitive Information vulnerability in Johnson Controls EasyIO NEO allows - Man In the Middle Attack. This issue affects EasyIO NEO: before 3.3b25...
CVE-2026-104182
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a...
CVE-2026-104183
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, Assembler materializes object properties with plain assignment, so an input key named proto invokes the inherited setter and causes parsed object prototype replacemen...
CVE-2026-71453
External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack. This issue affects EasyIO FS32: before 3.0b63...
CVE-2026-71453
The Johnson Controls EasyIO FS32 firmware (versions before 3.0b63 ) is vulnerable to an External Control of File Name or Path vulnerability. This flaw allows an attacker to perform a traversal attack , potentially enabling unauthorized access to files or directories outside the intended scope. No...
CVE-2026-71453
External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack. This issue affects EasyIO FS32: before 3.0b63...
CVE-2026-104020 Uncontrolled recursion in the Ion reader in Amazon Ion Python
Uncontrolled recursion in the Ion reader in Amazon Ion Python before 0.15.0 might allow a remote unauthenticated actor to crash the application using the library, resulting in a denial of service, via a crafted, deeply nested Ion value. To remediate this issue, users should upgrade to version...
GO-2026-6553 OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack in github.com/openbao/openbao
OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack in github.com/openbao/openbao...
CVE-2026-104183 stream-json: Prototype pollution: Assembler writes this.current[this.key] on plain objects
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, Assembler materializes object properties with plain assignment, so an input key named proto invokes the inherited setter and causes parsed object prototype replacemen...
CVE-2026-104183 stream-json: Prototype pollution: Assembler writes this.current[this.key] on plain objects
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, Assembler materializes object properties with plain assignment, so an input key named proto invokes the inherited setter and causes parsed object prototype replacemen...
CVE-2026-104183
The stream-json micro-library (versions prior to 3.6.0 ) is vulnerable to a prototype pollution flaw within its Assembler component. The root cause is the use of plain assignment to materialize object properties, which allows an input key named __proto__ to invoke an inherited setter. This result...
CVE-2026-104183 stream-json: Prototype pollution: Assembler writes this.current[this.key] on plain objects
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, Assembler materializes object properties with plain assignment, so an input key named proto invokes the inherited setter and causes parsed object prototype replacemen...
CVE-2026-104182
The stream-json micro-library is vulnerable to a Denial of Service (DoS) via a flaw in its JSONC parser (specifically at stream-json/jsonc/parser.js and stream-json/jsonc/verifier.js). Prior to version 3.6.0 , the parser restarts comment-terminator scanning from the opening slash whenever a block...
CVE-2026-55396 Unencrypted UDP Control Traffic in Teledyne FLIR Robots running Aware2
Cleartext transmission without a cryptographic integrity check in operator control unit to robot UDP traffic in Teledyne FLIR Aware2 versions through 6.9.0.2 PackBot and 1.7.9 FirstLook allows adjacent unauthenticated attackers to intercept, hijack, or modify control traffic against Teledyne FLIR...
EUVD-2026-91008
Confluent Kafka Python client's HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive information due to improper TLS certificate validation...
CVE-2026-12542
A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not...
CVE-2026-102369
Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker-controlled input processed by the MacTool handler. An unauthenticated attacker on the same local network can replay login challenge data to obtain an administrative session, enable a privileged service th...
CVE-2026-102369
TP-Link Tapo C120 v1 and C200 V5 security cameras are vulnerable to unauthenticated remote code execution due to insufficient protection of login challenge data and a lack of input sanitization in the MacTool handler . An attacker on the same local network can replay login challenge data to gain ...
CVE-2026-47599
A flaw was found in the NVIDIA GPU Display Driver open-source kernel module. An unprivileged local attacker can exploit improper preservation of memory access permissions during Direct Memory Access DMA mapping, which controls how the graphics hardware accesses system memory. Successful...
CVE-2026-102825
A flaw was found in russh. The server fails to enforce the configured limit on maximum authentication attempts during user authentication. An unauthenticated remote attacker can exploit this flaw by continuously submitting authentication requests over a single connection. This allows an attacker ...