40328 matches found
MAL-2026-6754 Malicious code in yt-api-dlp (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4710e1aa4fe025aaed51f4958f3b514a6cb950b40069f424c7a5d9a2f85591c Package name yt-api-dlp is a single-token insertion away from the widely-used yt-dlp package, and the tarball contains a near-verbatim copy of the...
mongoose:fuzz: Heap-buffer-overflow in ppp_tx_frame
Project: https://github.com/cesanta/mongoose.git Detailed Report: https://oss-fuzz.com/testcase?key=5174989637353472 Project: mongoose Fuzzing Engine: libFuzzer Fuzz Target: fuzz Job Type: libfuzzerasanmongoose Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address: 0x7a9f4bbe01b0...
libredwg:llvmfuzz: Heap-buffer-overflow in dxf_entities_read
Detailed Report: https://oss-fuzz.com/testcase?key=4625202148081664 Project: libredwg Fuzzing Engine: honggfuzz Fuzz Target: llvmfuzz Job Type: honggfuzzasanlibredwg Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 8 Crash Address: 0x7803678e27c0 Crash State: dxfentitiesread dwgreaddxf...
password leak with netrc and user in URL
...
CVE-2026-27779 Gitea forwarded-proto handling allows public URL spoofing
Gitea versions before 1.25.5 accept malformed or injected forwarded-proto values when detecting public URLs, allowing spoofed canonical URL generation...
CVE-2026-27779 Gitea forwarded-proto handling allows public URL spoofing
Gitea versions before 1.25.5 accept malformed or injected forwarded-proto values when detecting public URLs, allowing spoofed canonical URL generation...
CVE-2026-27779
Gitea versions before 1.25.5 are vulnerable to an Access Control Bypass due to improper validation of the forwarded-proto header. An attacker can inject or manipulate this header to force the application to generate spoofed canonical URLs when detecting public URLs. The underlying issue resides i...
CVE-2026-27657
Gitea versions before 1.25.5 allow a user to change another user's primary email address...
CVE-2026-14607
A weakness has been identified in RT-Thread up to 5.0.2. This affects the function sysgetaddrinfo of the file components/lwp/lwpsyscall.c. Executing a manipulation of the argument aiaddr can lead to memory corruption. The attack can only be executed locally. The exploit has been made available to...
CVE-2026-14607 RT-Thread lwp_syscall.c sys_getaddrinfo memory corruption
A weakness has been identified in RT-Thread up to 5.0.2. This affects the function sysgetaddrinfo of the file components/lwp/lwpsyscall.c. Executing a manipulation of the argument aiaddr can lead to memory corruption. The attack can only be executed locally. The exploit has been made available to...
CVE-2026-14607 RT-Thread lwp_syscall.c sys_getaddrinfo memory corruption
A weakness has been identified in RT-Thread up to 5.0.2. This affects the function sysgetaddrinfo of the file components/lwp/lwpsyscall.c. Executing a manipulation of the argument aiaddr can lead to memory corruption. The attack can only be executed locally. The exploit has been made available to...
CVE-2026-14607
A weakness has been identified in RT-Thread up to 5.0.2. This affects the function sysgetaddrinfo of the file components/lwp/lwpsyscall.c. Executing a manipulation of the argument aiaddr can lead to memory corruption. The attack can only be executed locally. The exploit has been made available to...
CVE-2026-14607
CVE-2026-14607 affects RT-Thread up to 5.0.2, specifically the sys_getaddrinfo implementation in components/lwp/lwp_syscall.c. Manipulating the ai_addr argument can cause memory corruption; exploit public and local access required. A fix is being prepared in a pull request (RT-Thread/rt-thread#11...
CVE-2026-46464
creationtimestamp| type| source ---|---|--- 2026-07-03 17:51:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpr4dxghxb2z 2026-07-04 06:38:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpsh6gpyes2n...
CVE-2026-14620
creationtimestamp| type| source ---|---|--- 2026-07-03 17:04:38+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mpqzpoxq4c2i 2026-07-03 22:00:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mprkb56qhi2z...
CVE-2026-59234
creationtimestamp| type| source ---|---|--- 2026-07-03 14:41:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpqrpeabqu2l 2026-07-04 04:11:56+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mps6yxxuv723...
CVE-2026-56015
Net::IP::LPM versions before 1.11 for Perl allow a heap out-of-bounds read via an unbounded prefix length. add passes the prefix string to the trie builder addPrefixToTrie without checking it against the address width. addPrefixToTrie then walks the prefix buffer by prefixlength bits, reading...
EUVD-2026-41531
In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker-controlled URL from any client connected to the standard /services messaging endpoint, performs the HTTP request server-side, and returns the full response body to the caller. Because the...
CVE-2026-10055
In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker-controlled URL from any client connected to the standard /services messaging endpoint, performs the HTTP request server-side, and returns the full response body to the caller. Because the...