109691 matches found
CVE-2026-69279: Use After Free
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally...
CVE-2026-86714: Out-of-bounds Read
PX4 Autopilot through 1.17.0 contains a stack buffer over-read vulnerability in the netman system command that fails to validate interface name length. Attackers can supply interface names of 74 bytes or more via the -i option to read beyond buffer boundaries, leaking stack memory to console outp...
CVE-2026-86542 knowns before 0.30.0 Path Traversal via Import Name
knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated attackers to write files outside the imports directory. Attackers can supply traversal sequences in the name parameter to escape the imports directory and overwrite arbitrary files writable by the...
CVE-2026-86436
Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing authenticated accounts without content permissions to upload files. Attackers can upload polyglot files with attacker-chosen extensions to the public web root and execute code if t...
CVE-2026-86436 Lara Dashboard before 1.3.2 Missing Authorization in Post-Builder Media Upload Endpoints
Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing authenticated accounts without content permissions to upload files. Attackers can upload polyglot files with attacker-chosen extensions to the public web root and execute code if t...
CVE-2026-86436 Lara Dashboard before 1.3.2 Missing Authorization in Post-Builder Media Upload Endpoints
Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing authenticated accounts without content permissions to upload files. Attackers can upload polyglot files with attacker-chosen extensions to the public web root and execute code if t...
CVE-2026-86436 Lara Dashboard before 1.3.2 Missing Authorization in Post-Builder Media Upload Endpoints
Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing authenticated accounts without content permissions to upload files. Attackers can upload polyglot files with attacker-chosen extensions to the public web root and execute code if t...
CVE-2026-86436
Lara Dashboard before version 1.3.2 fails to enforce authorization on the post-builder image and video upload endpoints , permitting authenticated accounts without content permissions to upload files. Attackers can exploit this by uploading polyglot files with attacker-chosen extensions into the ...
MGASA-2026-0379 Updated exiv2 package fixes security vulnerabilities
Heap out-of-bounds write in RemoteIo when reading from a malicious remote server WebReady/Curl builds. CVE-2026-68546 Heap out-of-bounds read in RemoteIo when reading block-aligned remote CRW files. CVE-2026-68547 Out of bounds read in CrwMap::decodeBasic. CVE-2026-49275...
USN-8733-1: Gzip vulnerabilities
Michał Majchrowicz and Marcin Wyczechowski discovered that Gzip's gzexe utility created temporary files in an insecure manner when mktemp was unavailable. A local attacker could possibly use this issue to overwrite arbitrary files. CVE-2026-41991 Elias Hasas, Michał Majchrowicz and Marcin...
USN-8733-1 gzip vulnerabilities
Michał Majchrowicz and Marcin Wyczechowski discovered that Gzip's gzexe utility created temporary files in an insecure manner when mktemp was unavailable. A local attacker could possibly use this issue to overwrite arbitrary files. CVE-2026-41991 Elias Hasas, Michał Majchrowicz and Marcin...
Server-Side Request Forgery (SSRF)
Spring Cloud Function is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of user-controlled file or resource paths, allowing an attacker to read arbitrary local files or make requests to attacker-controlled or internal resources...
CVE-2026-78043
The Windows Interactive Service in OpenVPN 2.7alpha1 through 2.7.6 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via specially crafted paths...
CVE-2026-53800
A Time-of-Check Time-of-Use TOCTOU race condition in rsync's --remove-source-files option allows a local attacker to delete arbitrary files. By replacing a source file with a symlink immediately after transfer but before deletion, the attacker can force rsync to delete the symlink target, resulti...
PT-2026-86919
Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing authenticated accounts without content permissions to upload files. Attackers can upload polyglot files with attacker-chosen extensions to the public web root and execute code if t...
CVE-2026-86347: Missing Authorization
Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile because the ACL entry for templates/uploadFile used the wildcard . This bypasses the intended role restrictions applied to neighboring template-management operations. The upload handler accepts...
UBUNTU-CVE-2026-68547
GHSA-jcgh-p9v3-pw6j: Heap out-of-bounds read in RemoteIo when reading block-aligned remote CRW files...
CVE-2026-68547
GHSA-jcgh-p9v3-pw6j: Heap out-of-bounds read in RemoteIo when reading block-aligned remote CRW files...
ROS-20260907-73-0099
The vulnerabilities of the ECCurve.java and ECCurve.cs files from the Math key verification library of the EC module in the Bouncy Castle Crypto Package for Java BC Java, Bouncy Castle Java Long Term Stable LTS BC-LJA, Bouncy Castle FIPS Java API BC-FJA, and Bouncy Castle Cryptography Library for...
CVE-2026-86253
h3 npm package versions = 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic. On Node.js deployments, event.url.pathname is not normalized, so percent-encoded dot segments %2e%2e are passed to decodeURI and decoded to ../ sequences without sanitization. An unauthenticated remote...