CVE-2026-45292

creationtimestamp| type| source ---|---|--- 2026-07-01 15:16:10+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mplspxj3ro22...

CVE-2026-45292 opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators...

CVE-2026-45292

The CVE-2026-45292 issue affects OpenTelemetry Java components: baggage propagation in opentelemetry-api and opentelemetry-extension-trace-propagators prior to 1.62.0. The vulnerability arises from parsing oversized baggage, causing unbounded memory allocation and high CPU usage, with baggage re-...

be.vlaanderen.informatievlaanderen.ldes.ldio:ldio-application (=2.12.0), be.vlaanderen.informatievlaanderen.vsds:ldes-server-admin (>=2.10.0 <=3.4.0) +556 more potentially affected by CVE-2026-45292 via io.opentelemetry:opentelemetry-extension-trace-propagators (>=0.7.0 <=1.61.0)

io.opentelemetry:opentelemetry-extension-trace-propagators MAVEN version =0.7.0, =2.10.0, =3.6.0, =1.1.0, =2.10.0, =2.10.0, =2.10.0, =3.0.0, =3.3.0, =3.3.0, =3.3.0, =3.3.0, =3.4.0 - br.com.sawcunhaos:scos-foundation-security =1.1.0 - ch.admin.bit.jeap:jeap-archrepo-dbsc...

ai.agentican:agentican-quarkus-otel (>=0.1.0-alpha.1 <=0.1.0-alpha.4), ai.agentican:agentican-quarkus-otel-store-jpa (>=0.1.0-alpha.1 <=0.1.0-alpha.4) +10807 more potentially affected by CVE-2026-45292 via io.opentelemetry:opentelemetry-api (>=0.2.0 <=1.61.0)

io.opentelemetry:opentelemetry-api MAVEN version =0.2.0, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.21.0-alpha.2, =0.1.1, =0.1.1, =0.1.1, =0.0.1, =3.10.0.5, =1.0.0, =1.0.0, =0.3.0, =1.0.0, =1.0.0-beta, =1.0.0-beta-preview7 and more Source cves: CVE-2026-45292 Source...

CVE-2024-45292

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. \PhpOffice\PhpSpreadsheet\Writer\Html does not sanitize "javascript:" URLs from hyperlink href attributes, resulting in a Cross-Site Scripting vulnerability. This issue has been addressed in release versions 1.29.2,...

CVE-2024-45292 PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. \PhpOffice\PhpSpreadsheet\Writer\Html does not sanitize "javascript:" URLs from hyperlink href attributes, resulting in a Cross-Site Scripting vulnerability. This issue has been addressed in release versions 1.29.2,...

CVE-2024-45292 PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. \PhpOffice\PhpSpreadsheet\Writer\Html does not sanitize "javascript:" URLs from hyperlink href attributes, resulting in a Cross-Site Scripting vulnerability. This issue has been addressed in release versions 1.29.2,...

CVE-2024-45292 PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. \PhpOffice\PhpSpreadsheet\Writer\Html does not sanitize "javascript:" URLs from hyperlink href attributes, resulting in a Cross-Site Scripting vulnerability. This issue has been addressed in release versions 1.29.2,...

CVE-2024-45292

creationtimestamp| type| source ---|---|--- 2024-10-07 15:06:47+00:00| published-proof-of-concept| https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-r8w8-74ww-j4wh 2024-10-07 22:39:27+00:00| seen| https://t.me/cvedetector/7273 2025-03-08 04:35:51+00:00| seen|...

CVE-2023-45292

creationtimestamp| type| source ---|---|--- 2024-01-02 07:36:12+00:00| seen| https://t.me/ctinow/161539...

CVE-2023-50119

DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-45292. Reason: This record is a reservation duplicate of CVE-2023-45292. Notes: All CVE users should reference CVE-2023-45292 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage...

CVE-2023-50119

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-45292. Reason: This record is a reservation duplicate of CVE-2023-45292. Notes: All CVE users should reference CVE-2023-45292 instead of this record. All references and descriptions in this record have been removed to prevent...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-45292. Reason: This record is a reservation duplicate of CVE-2023-45292. Notes: All CVE users should reference CVE-2023-45292 instead of this record. All references and descriptions in this record have been removed to prevent...

CVE-2023-45292 Captcha verification bypass in github.com/mojocn/base64Captcha

When using the default implementation of Verify to check a Captcha, verification can be bypassed. For example, if the first parameter is a non-existent id, the second parameter is an empty string, and the third parameter is true, the function will always consider the Captcha to be correct...

CVE-2023-45292

CVE-2023-45292 describes a Captcha verification bypass in the Go package github.com/mojocn/base64Captcha. The Default Verify function can incorrectly treat a request as valid when the first parameter is a non-existent ID, the second parameter is an empty string, and the third parameter is true, a...

CVE-2022-45292

User invites for Funkwhale v1.2.8 do not permanently expire after being used for signup and can be used again after an account has been deleted...

CVE-2022-45292

CVE-2022-45292 affects Funkwhale v1.2.8. The vulnerability is that user invites do not permanently expire after signup and invites can be reused after the associated account is deleted, enabling potential reuse of invitations and account abuse. The connected PT-2022-27460 entry provides the affec...

CVE-2021-45292

creationtimestamp| type| source ---|---|--- 2021-12-21 20:12:23+00:00| seen| https://t.me/cibsecurity/34453...

CVE-2021-45292

The gfisomhintrtpread function in GPAC 1.0.1 allows attackers to cause a denial of service Invalid memory address dereference via a crafted file in the MP4Box command...