217672 matches found
CVE-2026-54638 td has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.Decode
gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencryptedmessage.go read attacker controlled dataLen from an unauthenticated MTProto unencrypted packet and allocated makebyte, dataLen before checking the remaining buffer, allowing...
EUVD-2026-50077
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.17.0 until 0.60.2, datamodel-code-generator preserves attacker-controlled defaultfactory values in...
CVE-2026-54653
The CVE affects the datamodel-code-generator project. From versions 0.17.0 through 0.60.2, the tool could preserve attacker-controlled default_factory values in JsonSchemaObject.init/get_field_extras, emitting them into Field(default_factory=...) and enabling Python expression execution when the ...
EUVD-2026-50067
datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered into Python comments in src/datamodelcodegenerator/model/template/TypeAliasAnnotation.jinja2,...
DEBIAN-CVE-2026-59942
Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a Denial of Service DoS attack via resource exhaustion. An attacker can crash the PHP process by providing a specially crafted HTML document containing a single image with massive dimensions e.g., 30,000x30,000...
CVE-2026-14958
IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation...
CVE-2026-14959
IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to shell command injection...
CVE-2026-13463
IBM Cloud Pak System 2.3.5.0 could allow a local attacker to obtain sensitive information due to the insertion of credentials into log files...
kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception level resources
A flaw was found in the Linux kernel on ARM processors. A race condition in Translation Lookaside Buffer Invalidation TLBI operations during memory permission changes allows a local attacker to write to memory resources owned by higher privilege levels. This could allow an unprivileged local...
EUVD-2026-50065
IBM Cloud Pak System 2.3.5.0 could allow a local attacker to obtain sensitive information due to the insertion of credentials into log files...
CVE-2026-13463
IBM Cloud Pak System 2.3.5.0 is affected by CVE-2026-13463 due to hard-coded credentials in IBM Storage Protect leading to local disclosure of sensitive information via log files. The IBM Security Bulletin (CVE-2026-13463) notes the root cause CWE-798 and specifies a fix: upgrade to version 2.3.5...
CVE-2026-13463 Due to use of IBM Storage Protect, IBM Cloud Pak System is affected by vulnerability []
IBM Cloud Pak System 2.3.5.0 could allow a local attacker to obtain sensitive information due to the insertion of credentials into log files...
CVE-2026-13463 Due to use of IBM Storage Protect, IBM Cloud Pak System is affected by vulnerability []
IBM Cloud Pak System 2.3.5.0 could allow a local attacker to obtain sensitive information due to the insertion of credentials into log files...
CVE-2026-59941 Dompdf: Uncontrolled resource consumption based on declared BMP dimensions
Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whose header declares e.g. 6000×6000 is...
CVE-2026-59942 Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps
Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a Denial of Service DoS attack via resource exhaustion. An attacker can crash the PHP process by providing a specially crafted HTML document containing a single image with massive dimensions e.g., 30,000x30,000...
CVE-2026-59942
Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a Denial of Service DoS attack via resource exhaustion. An attacker can crash the PHP process by providing a specially crafted HTML document containing a single image with massive dimensions e.g., 30,000x30,000...
EUVD-2026-50059
IBM WebSphere Application Server 9.0, and 8.5 traditional could allow a remote attacker to obtain sensitive information...
CVE-2026-14958 OS command injection in IBM Aspera Faspex
IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation...