CVE-2026-38360

CVE-2026-38360: Path Traversal in dash-uploader...

dash-uploader 0.1.0 - 0.7.0a2 - Denial-of-Service via flowTotalChunks

fohrloop dash-uploader v0.1.0 through v0.7.0a2 contains a remote code execution caused by improper handling in Upload function and maxfilesize parameter in dashuploader components, letting remote attackers execute arbitrary code, exploit requires crafted request. id: CVE-2026-38361 info: name:...

dash-uploader 0.1.0 - 0.7.0a2 - Unauthenticated Arbitrary File Write via Path Traversal

fohrloop dash-uploader v0.1.0 through v0.7.0a2 contains a directory traversal vulnerability caused by improper handling in dashuploader/httprequesthandler.py components, letting remote attackers execute arbitrary code, exploit requires no special privileges. id: CVE-2026-38360 info: name:...

Dash Framework - Cross-site Scripting

Dash framework versions before 2.15.0 are vulnerable to Cross-site Scripting XSS via href attribute in anchor tags. This template tests for javascript:alert payload injection. id: CVE-2024-21485 info: name: Dash Framework - Cross-site Scripting author: Lee Changhyuneeche severity: medium...

CVE-2026-38361

CVE-2026-38361: Multiple vulnerabilità DoS non autenticate in dash-uploader...

CVE-2026-75146

A flaw was found in FFmpeg. A malicious or misconfigured DASH Dynamic Adaptive Streaming over HTTP server can exploit an out-of-bounds read vulnerability in the DASH demuxer. This occurs when a live DASH manifest is refreshed with a startNumber that is lower than the previous value, causing a...

CVE-2026-81102

The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcpserverdash.py constructed the server for its network mode with the interface restricted to loopback and no transport-security settings, so a name that had been pointed at the loopback...

CVE-2026-81102

CVE-2026-81102 affects the Dropbox Dash MCP server (src/mcp_server_dash.py), which in its network mode bound its listener to the loopback address but never validated the Host header , and included no transport-security settings. This allowed a DNS rebinding attack: a malicious page in a visitor's...

CVE-2026-81102 Dropbox Dash MCP Server DNS Rebinding via Missing Host Header Validation

The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcpserverdash.py constructed the server for its network mode with the interface restricted to loopback and no transport-security settings, so a name that had been pointed at the loopback...

EUVD-2026-67030

The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcpserverdash.py constructed the server for its network mode with the interface restricted to loopback and no transport-security settings, so a name that had been pointed at the loopback...

CVE-2026-81102 Dropbox Dash MCP Server DNS Rebinding via Missing Host Header Validation

The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcpserverdash.py constructed the server for its network mode with the interface restricted to loopback and no transport-security settings, so a name that had been pointed at the loopback...

PT-2026-82575

Name of the Vulnerable Software and Affected Versions Dash MCP server affected versions not specified Description In network mode, the server binds its listener to the loopback address but fails to verify the host name of incoming requests. Within src/mcp server dash.py, the server is configured...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read in the fragment retrieval function when a live DASH manifest is refreshed with a startNumber lower than the previous value. An attacker can cause out-of-bounds memory access by serving a malicious or misconfigured DAS...

Linux Distros Unpatched Vulnerability : CVE-2026-75146

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer libavformat/dashdec.c. When a live DASH manifest is refreshed with a startNumber...

CVE-2026-75146

FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer libavformat/dashdec.c. When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the...

EUVD-2026-62583

FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer libavformat/dashdec.c. When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the...

CVE-2026-75146 FFmpeg Out-of-Bounds Read in DASH Demuxer via dashdec.c

FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer libavformat/dashdec.c. When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the...

CVE-2026-75146

FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper ...

CVE-2026-73411

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/unix/dash.js fails to escape after : or = when applications use the escape or escapeAll APIs on Unix with shell set to dash, or with shell set to true when Dash is the default, a...

CVE-2026-73411

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/unix/dash.js fails to escape after : or = when applications use the escape or escapeAll APIs on Unix with shell set to dash, or with shell set to true when Dash is the default, a...