109747 matches found
CVE-2026-47894: Undefined Security Weakness
Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier...
NULL Pointer Dereference
Overview Affected versions of this package are vulnerable to NULL Pointer Dereference in the getminbuffersize function when processing specially crafted video files. An attacker can cause the application to crash by supplying a maliciously crafted video file. Remediation Upgrade ffmpeg to version...
Malcolm v26.08.0
Malcolm Malcolm is a powerful network traffic analysis tool suite designed with the following goals in mind: Easy to use – Malcolm accepts network traffic data in the form of full packet capture PCAP files, Zeek logs, and Suricata alerts. These artifacts can be uploaded via a simple browser-based...
CVE-2026-80426
FiftyOne renders a dataset field's description as markup. The sidebar field-information component at app/packages/core/src/components/FieldLabelAndInfo/index.tsx passes the description string to React's dangerouslySetInnerHTML, and no layer between storage and render escapes or sanitises it; the...
GO-2026-6293 Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5
Encoded slash %2F bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5...
Security update for go1.27
This update for go1.27 fixes the following issues: go1.27.0 released 2026-08-19 is a major release of Go. go1.27.x minor releases will be provided through August 2027. https://github.com/golang/go/wiki/Go-Release-Cycle go1.27 arrives six months after Go 1.26. Most of its changes are in the...
CVE-2026-77658
A stack-based buffer overflow vulnerability exists in the Dia diagram editor when processing Network Bus objects from Dia XML project files. In objects/network/bus.c, busload reads the number of bus handles from the file attribute "bushandles" using attributenumdata without validating an upper...
CVE-2026-77658
A stack-based buffer overflow in the Dia diagram editor (0.98.0 and earlier) occurs when processing Network Bus objects from XML project files. In bus_load(), the bus_handles count is read without an upper bound and later passed to g_alloca() in bus_handle_moved(), allocating two stack arrays pro...
CVE-2026-80234
CAYIN CMS-WS and CMS-SE developed by CAYIN Technology have a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain media file lists via specific functionality, resulting in partial information disclosure...
Path Traversal
Whistle is vulnerable to Path Traversal. The vulnerability is due to improper validation of the user-supplied filename parameter, which allows a remote attacker to access and read arbitrary files from the server, such as /etc/passwd...
Malcolm v26.08.0
Malcolm Malcolm is a powerful network traffic analysis tool suite designed with the following goals in mind: Easy to use – Malcolm accepts network traffic data in the form of full packet capture PCAP files, Zeek logs, and Suricata alerts. These artifacts can be uploaded via a simple browser-based...
CVE-2026-75331: Unrestricted Upload of File with Dangerous Type
tamguo 1.5.3 is vulnerable to Unrestricted File Upload Leading to Stored XSS. The /uploadFile and /imgUpload endpoints in FileUploadController.java and UEditorController.java have no file type validation. Attackers can upload arbitrary HTML/JavaScript files to the server...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kf5-kconfig (UTSA-2026-093173)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093173 advisory. In KDE Frameworks KConfig before 5.61.0, malicious desktop files and configuration files lead to code execution with minimal user interaction. This relates to...
Oracle Linux 9 : nginx:1.26 (ELSA-2026-59496)
The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-59496 advisory. - Fixes CVE-2026-56434 and CVE-2026-60005 - nginx: code execution and denial of service CVE-2026-9256 - Resolves: RHEL-176218 - nginx:1.26/nginx: NGIN...
PT-2026-88955
Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.60 Description GitPython fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files such as gitdir, commondir, and HEAD. An attacker can execut...
CVE-2026-62865
Typebot is an open-source chatbot builder. In self-hosted versions prior to 3.18.0, the server-side Send Email integration block allows arbitrary reading of local files on the server. The block builds Nodemailer attachments from a typebot variable, and its parseAttachments helper returns the...
CVE-2026-32637
Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1, an attacker who compromises the backup object-storage backend can upload a malicious backup tarball containing parent-directory paths that escape the...
DEBIAN-CVE-2026-68515
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, exrmultiview can write past a heap allocation when it combines two attacker-supplied,...
