29261 matches found
Safety Graph: When Safety Responses Become Attack Surfaces in Cyber-Physical Systems
Modern industrial control systems ICS are susceptible to cyber attacks triggering safety failures in the operational technology OT layer. The traditional way to mitigate any failure in OT is to implement safety responses. However, we show in this work that these responses can open up new attack...
CVE-2026-62041: Missing Authorization
Missing Authorization vulnerability in Ashok Dudhat WP Event Manager wp-event-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Manager: from n/a through 3.4.1...
CVE-2026-79363: Improper Neutralization of Input During Web Page Generation
Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting XSS vulnerability in the Branding Footer feature. An authenticated administrator can store crafted HTML containing JavaScript event handlers in the Footer setting. The stored value is rendered without sufficient sanitization on the publ...
CVE-2026-79363
Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting XSS vulnerability in the Branding Footer feature. An authenticated administrator can store crafted HTML containing JavaScript event handlers in the Footer setting. The stored value is rendered without sufficient sanitization on the publ...
CVE-2026-83947
Missing authorization in Azure Event Grid allows an authorized attacker to perform spoofing over a network...
CVE-2026-83947
A missing authorization vulnerability in Azure Event Grid allows an authorized attacker to perform spoofing over a network. The issue is classified under CWE-862 and carries a HIGH base severity score of 7.7. While the specific root cause and affected versions are not detailed in the provided doc...
com.consol.citrus:citrus-vertx (2.2), com.erudika:para (>=1.5.1, <=1.8.0) +51 more potentially affected by CVE-2026-107726 via com.hazelcast:hazelcast (3.2.3)
com.hazelcast:hazelcast MAVEN version 3.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.consol.citrus:citrus-vertx 2.2 - com.erudika:para =1.5.1, =1.2.1, =1.4.4 -...
CVE-2026-107397
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can create content, including speakers who can create minutes, can store crafted HTML in event minutes. When concurrent edits are made to the same minutes, t...
CVE-2026-107391
music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sample-entry size of zero to prevent the StsdAtom.get cursor fr...
EUVD-2026-95253
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can create content, including speakers who can create minutes, can store crafted HTML in event minutes. When concurrent edits are made to the same minutes, t...
CVE-2026-107394 Indico: Incomplete Server-Side Request Forgery (SSRF) check
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, the previous fix for CVE-2026-25738 did not cover an edge case, allowing an event organizer to submit a crafted URL that points to a prohibited local target but is...
CVE-2026-107394 Indico: Incomplete Server-Side Request Forgery (SSRF) check
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, the previous fix for CVE-2026-25738 did not cover an edge case, allowing an event organizer to submit a crafted URL that points to a prohibited local target but is...
CVE-2026-107394 Indico: Incomplete Server-Side Request Forgery (SSRF) check
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, the previous fix for CVE-2026-25738 did not cover an edge case, allowing an event organizer to submit a crafted URL that points to a prohibited local target but is...
CVE-2026-107394
The event management system Indico is vulnerable to a Server-Side Request Forgery (SSRF) flaw in versions prior to 3.3.13 . The root cause is an incomplete check in the Flask-Multipass authentication system, which failed to cover an edge case identified in a previous fix for CVE-2026-25738. This ...
EUVD-2026-95212
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, the previous fix for CVE-2026-25738 did not cover an edge case, allowing an event organizer to submit a crafted URL that points to a prohibited local target but is...
CVE-2026-107391 music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master
music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sample-entry size of zero to prevent the StsdAtom.get cursor fr...
CVE-2026-107391 music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master
music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sample-entry size of zero to prevent the StsdAtom.get cursor fr...
CVE-2026-107391
music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sample-entry size of zero to prevent the StsdAtom.get cursor fr...
CVE-2026-107391
The music-metadata library (NPM) versions >=11.0.0 and
GHSA-GCX5-HXJ7-GPQQ msgpack5: Quadratic parsing in the streaming decoder
Impact The streaming decoder reparses an incomplete container from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack value across many small chunks, causing quadratic CPU usage and blocking the event loop. Patches The decoder now preserves incremental...