CVE-2026-70607: Improper Input Validation

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, some window options supplied by web content in the window.open features string were applied to the new BrowserWindow without an allowlist...

Missing permission checks in xml-job-to-job-dsl

xml-job-to-job-dsl 0.1.13 and earlier does not perform permission checks, and makes its functionality available to users lacking Overall/Read permission. While only jobs the user has Item/Read permission for will be accessible, it does not require Item/Extended Read permission to convert their...

CVE-2026-45705

OpenSIPS CVE-2026-45705 affects the SIP server in versions prior to 3.6.6 and 4.0.0-rc1. The vulnerability is a out-of-bounds read in the multipart body parser, caused by the find_line_delimiter() function reading beyond the logical end of the MIME boundary when it encounters a boundary near the ...

CVE-2026-45705

OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the findlinedelimiter function in the multipart body parser performs an out-of-bounds read via strncmp when searching for MIME boundary delimiters. After finding a -- pattern near the en...

CVE-2026-45705 OpenSIPS: OOB Read in Multipart Body Boundary Parsing

OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the findlinedelimiter function in the multipart body parser performs an out-of-bounds read via strncmp when searching for MIME boundary delimiters. After finding a -- pattern near the en...

CVE-2026-45103

OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the TCP message framing layer parses the Content-Length header using unsigned int arithmetic with no overflow check. When an attacker sends a Content-Length value that overflows unsigned...

CVE-2026-70594

Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks. Successful exploitation would have required another vulnerability on the same domain where Ghost Admin was hosted...

CVE-2026-70590

Ghost is a Node.js content management system. Prior to 6.54.1, any staff-level user was able to leak the hashed passwords of other staff users through the Ghost Admin API. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification...

CVE-2026-45084

OpenSIPS is a Session Initiation Protocol SIP server implementation. Versions 3.4.0 through 3.6.5 contain a denial of service vulnerability in the presence module. When the presence module's handlepublish function processes a SIP PUBLISH request with an Event: presence header and a message body...

CVE-2026-45103

OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the TCP message framing layer parses the Content-Length header using unsigned int arithmetic with no overflow check. When an attacker sends a Content-Length value that overflows unsigned...

CVE-2026-45103

OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the TCP message framing layer parses the Content-Length header using unsigned int arithmetic with no overflow check. When an attacker sends a Content-Length value that overflows unsigned...

UBUNTU-CVE-2026-45103

OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the TCP message framing layer parses the Content-Length header using unsigned int arithmetic with no overflow check. When an attacker sends a Content-Length value that overflows unsigned...

UBUNTU-CVE-2026-45084

OpenSIPS is a Session Initiation Protocol SIP server implementation. Versions 3.4.0 through 3.6.5 contain a denial of service vulnerability in the presence module. When the presence module's handlepublish function processes a SIP PUBLISH request with an Event: presence header and a message body...

CVE-2026-45084

OpenSIPS is a Session Initiation Protocol SIP server implementation. Versions 3.4.0 through 3.6.5 contain a denial of service vulnerability in the presence module. When the presence module's handlepublish function processes a SIP PUBLISH request with an Event: presence header and a message body...

CVE-2026-45103 OpenSIPS: SIP Message Smuggling via TCP Content-Length Integer Overflow

OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the TCP message framing layer parses the Content-Length header using unsigned int arithmetic with no overflow check. When an attacker sends a Content-Length value that overflows unsigned...

EUVD-2026-52979

OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the TCP message framing layer parses the Content-Length header using unsigned int arithmetic with no overflow check. When an attacker sends a Content-Length value that overflows unsigned...

CVE-2026-45103 OpenSIPS: SIP Message Smuggling via TCP Content-Length Integer Overflow

OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the TCP message framing layer parses the Content-Length header using unsigned int arithmetic with no overflow check. When an attacker sends a Content-Length value that overflows unsigned...

CVE-2026-45103

OpenSIPS vulnerable to SIP message smuggling via TCP Content-Length overflow. In versions < 3.6.6 and

CVE-2026-45103

OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the TCP message framing layer parses the Content-Length header using unsigned int arithmetic with no overflow check. When an attacker sends a Content-Length value that overflows unsigned...

CVE-2026-45103 OpenSIPS: SIP Message Smuggling via TCP Content-Length Integer Overflow

OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the TCP message framing layer parses the Content-Length header using unsigned int arithmetic with no overflow check. When an attacker sends a Content-Length value that overflows unsigned...