37384 matches found
imagemagick-gs-delegate-hijack-poc
ImageMagick Ghostscript Delegate Search Path PoC This reposit...
SUSE CVE-2026-6040
A heap use-after-free existed when importing the blank-width characters of an ODF number format. A position value read from the document was not checked against the length of the format-code string, so a malformed number format could be processed against memory outside that string. In fixed...
SUSE CVE-2026-12316
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152 and Thunderbird 152...
SUSE CVE-2026-12323
Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 152 and Thunderbird 152...
Vulnerability of the DOM component: Available in Mozilla Firefox, Firefox ESR, and Thunderbird email client browsers, allowing attackers to perform spoofing attacks.
The vulnerability of the DOM component: The Core and HTML browsers of Mozilla Firefox, Firefox ESR, and the email client Thunderbird are vulnerable to attacks that involve bypassing authentication procedures through spoofing. Exploiting this vulnerability allows attackers to carry out spoofing...
Oj - Use-After-Free in Oj::Doc Iterators via Reentrant Close
Summary Oj::Doc iterators eachvalue, eachchild, eachleaf are vulnerable to a heap use-after-free. When a Ruby block yielded during iteration calls doc.close or d.close, the document's heap memory is freed while the C iterator is still running. When control returns from the block, the iterator rea...
MINI-F6P5-PM4F-XGXP
Bulletin has no description...
MINI-X2FW-P82Q-V99H
Bulletin has no description...
MINI-MFXQ-6FPJ-7GH7
Bulletin has no description...
EUVD-2026-4492
gemini-mcp-tool vulnerable to OS command injection and @file exfiltration via prompt quoting CVE-2026-0755...
CVE-2026-48716 nanobot: Path traversal via unsanitized WhatsApp document fileName enables arbitrary file write
nanobot is a personal AI assistant. In versions 0.1.5.post3 and prior, the WhatsApp bridge in bridge/src/whatsapp.ts constructs a filesystem path using the fileName field from an incoming WhatsApp document message without sanitization. The WhatsApp bridge downloads media attachments and writes th...
CGA-4MWV-6XRJ-9CG9
Bulletin has no description...
GHSA-JR45-52CW-69H5 NL Portal Backend Libraries: Document contents remained downloadable by any logged-in user (incomplete fix of CVE-2026-49463)
Summary A previous advisory CVE-2026-49463 / GHSA-qpm9-h556-mwxm reported that any logged-in user could download any document by its identifier, and stated this was fixed in 3.0.1. For the document-content part that fix was incomplete: documents remained downloadable by any authenticated user in...
MINI-2R3G-QFJ3-33RJ
Bulletin has no description...
CVE-2026-8811
SEPPmail versions before 15.0.5 allow improper handling of attachment filenames during encrypted PDF generation. An attacker can exploit this to create new files outside the intended directory, potentially placing files in web-accessible locations...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the document conversion process. An attacker can cause the server to make arbitrary outbound HTTPS requests or access local image files by uploading a specially crafted DOCX document that references...
Gotenberg: SSRF via LibreOffice document processing
Summary Server-Side Request Forgery SSRF vulnerability affecting the /forms/libreoffice/convert endpoint in Gotenberg v8.33.0 running with the default configuration. By uploading a specially crafted DOCX document, an attacker can cause LibreOffice to automatically retrieve external resources duri...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the document conversion process. An attacker can cause the server to make arbitrary outbound HTTPS requests or access local image files by uploading a specially crafted DOCX document that references...