77958 matches found
EUVD-2026-67302
cpp-httplib is a C++ header-only HTTP/HTTPS library. In versions 0.33.0 through 0.50.0, the TLS-enabled WebSocket client frees the TLS session before closing the WebSocket that still uses it, producing a use-after-free. In WebSocketClient::shutdownandclose the SSL object is freed and the pointer...
CVE-2026-77358
cpp-httplib , a C++ header-only HTTP/HTTPS library, is affected by a use-after-free vulnerability in its TLS-enabled WebSocket client (versions 0.33.0 through 0.50.0 ). In WebSocketClient::shutdown_and_close(), the SSL object is freed and its pointer cleared before the WebSocket close frame is se...
CVE-2026-77358 cpp-httplib: Use-after-free of TLS session in WebSocketClient::shutdown_and_close()
cpp-httplib is a C++ header-only HTTP/HTTPS library. In versions 0.33.0 through 0.50.0, the TLS-enabled WebSocket client frees the TLS session before closing the WebSocket that still uses it, producing a use-after-free. In WebSocketClient::shutdownandclose the SSL object is freed and the pointer...
CVE-2026-76945 Ebyte NE2-D11 Use of Client-Side Authentication
The affected Ebyte device relies on client-managed authentication tokens without sufficient server-side validation. An attacker may replay or manipulate authentication tokens to gain unauthorized access to administrative functionality...
CVE-2026-76945 Ebyte NE2-D11 Use of Client-Side Authentication
The affected Ebyte device relies on client-managed authentication tokens without sufficient server-side validation. An attacker may replay or manipulate authentication tokens to gain unauthorized access to administrative functionality...
CVE-2026-76945
CVE-2026-76945 affects the Ebyte NE2-D11 device. The root cause is client-managed authentication tokens without sufficient server-side validation , allowing an attacker to replay or manipulate tokens to gain unauthorized access to administrative functionality . The primary impact is confidentiali...
fastrepl-client (0.0.1) potentially affected by CVE-2026-37004 via litellm (0.4.4)
litellm PYPI version 0.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - fastrepl-client 0.0.1 Source cves: CVE-2026-37004 Source advisory: OSV:GHSA-6WVF-77M9-58RM...
CVE-2026-71187
Ebyte NE2-D11 contains a vulnerability in its client-side authentication logic that unauthenticated users can reproduce, allowing an attacker to generate valid authentication requests and bypass authentication entirely to obtain administrative access to the device. The flaw is assessed CRITICAL (...
CVE-2026-71187 Ebyte NA111-M Use of Client-Side Authentication
The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacker may generate valid authentication requests and bypass authentication to obtain administrative access to the device...
CVE-2026-71187 Ebyte NA111-M Use of Client-Side Authentication
The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacker may generate valid authentication requests and bypass authentication to obtain administrative access to the device...
CVE-2026-81530
A weakness in the client-side encryption configuration surface of the MongoDB C Driver causes sensitive key-management credential material supplied by the application to be reproduced verbatim in the driver's human-readable diagnostic representation of its client settings, instead of being masked...
DEBIAN-CVE-2026-81525
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations...
CVE-2026-81525
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations...
UBUNTU-CVE-2026-81521
The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name...
UBUNTU-CVE-2026-81525
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations...
CVE-2026-59287
Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.3.0 - 1.3.9...
EUVD-2026-67225
Unrestricted Upload of File with Dangerous Type in the product photo upload in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated user holding the create product permission routine Seller role to execute arbitrary JavaScript in the application origin. The photo validation rule...
EUVD-2026-67214
A weakness in the client-side encryption configuration surface of the MongoDB C Driver causes sensitive key-management credential material supplied by the application to be reproduced verbatim in the driver's human-readable diagnostic representation of its client settings, instead of being masked...
KMS master key exposure via unredacted credential serialization in driver settings string
A weakness in the client-side encryption configuration surface of the MongoDB C Driver causes sensitive key-management credential material supplied by the application to be reproduced verbatim in the driver's human-readable diagnostic representation of its client settings, instead of being masked...
