416 matches found
CVE-2026-112779
Grav API plugin grav-plugin-api 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/translations/lang endpoint, and 1.0.16 before 1.0.42 fails to check target and destination page rules in the sync and batch copy...
EUVD-2026-104585
Grav API plugin grav-plugin-api 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/translations/lang endpoint, and 1.0.16 before 1.0.42 fails to check target and destination page rules in the sync and batch copy...
CVE-2026-110843 n8n before 2.41.4 and 2.42.1 Unauthenticated Unbounded OAuth Client Persistence via Authorize Endpoint
n8n before 2.41.4 and 2.42.x before 2.42.1 contains an uncontrolled resource consumption vulnerability in the unauthenticated OAuth authorize endpoint, which resolves clients by URL path but stores the caller's raw identifier as the record key. Unauthenticated attackers can send identifiers...
CVE-2026-96618
The hexpm hex package (versions 0.11.2 before 2.5.2) is vulnerable to a Data Amplification attack where an untrusted mirror can exhaust a machine's memory or disk space. The root cause is that Hex.HTTP.request/5 decompresses gzip responses without enforcing size limits, and package tarballs/docs ...
CVE-2026-96618 Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror
Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. Hex treats a mirror configured with...
CVE-2026-96618 Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror
Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. Hex treats a mirror configured with...
EEF-CVE-2026-96618 Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror
Summary Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. Hex treats a mirror configure...
CVE-2026-109205
LogicalDOC Community Edition through version 9.3 is vulnerable to an unauthenticated file upload flaw in the UploadServlet . The root cause is the lack of limits on multipart requests sent to the /upload endpoint, which allows remote attackers to write files to disk without a session. By repeated...
EUVD-2026-97440
LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that allows remote attackers to write files to disk without a session. Attackers can repeatedly send multipart requests with unlimited file parts to /upload, persisting files in...
CVE-2026-109205 LogicalDOC Community Edition through 9.3 Unauthenticated Upload Disk Exhaustion via UploadServlet
LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that allows remote attackers to write files to disk without a session. Attackers can repeatedly send multipart requests with unlimited file parts to /upload, persisting files in...
CVE-2026-109205 LogicalDOC Community Edition through 9.3 Unauthenticated Upload Disk Exhaustion via UploadServlet
LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that allows remote attackers to write files to disk without a session. Attackers can repeatedly send multipart requests with unlimited file parts to /upload, persisting files in...
PT-2026-110652
Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. Hex treats a mirror configured with H...
Vikunja: Denial of service via decompression bomb in the data import
Summary Vikunja lets you export your data as a zip and import it back. The import doesn't limit how large the archive expands to, how many files it contains, or how much storage one user can consume, and it appears to hold the whole archive in memory while processing it. Because the archive is...
CVE-2026-107335
Malcolm's upload-processing pipeline scripts/safe-extract.py enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives zip/tar/rar/7z via libarchive, but those limits are not applied when the uploaded file is a single-stream compressed format .gz,...
Improper Handling of Highly Compressed Data (Data Amplification)
Overview Magick.NET-Q16-AnyCPU is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...
Improper Handling of Highly Compressed Data (Data Amplification)
Overview Magick.NET-Q16-HDRI-OpenMP-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this...
Improper Handling of Highly Compressed Data (Data Amplification)
Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification in the MAT decoder due to improper enforcement of configured temporary file size limits when processing highly compressed data. An attacker can exhaust disk resources by...
Improper Handling of Highly Compressed Data (Data Amplification)
Overview Magick.NET-Q8-OpenMP-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package ar...
Debian dla-4800 : glance - security update
The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4800 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4800-1 [email protected]...