66581 matches found
PT-2026-80972
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the switch lan gvrp function. The vulnerability is caused by unsafe copying of the portList field into an undersized buffer. A remote attacker can trigger this vulnerability via crafted input, causing a denial of servi...
CVE-2026-52492
An integer overflow in the libtiff rgb2ycbcr utility's cvtRaster function when computing strip buffer sizes can result in an undersized heap allocation and subsequent heap-based buffer overflow during YCbCr conversion of a crafted TIFF image...
PT-2026-80976
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the mail mailalert function. The vulnerability is caused by concatenating multiple smtpReceiver email addresses into a fixed-size buffer without checking the remaining buffer size. A remote attacker can trigger this...
PT-2026-79814
A vulnerability was identified in rexrainbow phaser3-rex-notes up to 1.80.17. This vulnerability affects the function SetValue of the file plugins/utils/object/SetValue.js of the component BehaviorTree Blackboard Data Interface. Such manipulation of the argument key leads to improperly controlled...
SPIP X-Spip-Filtre Unauthenticated Remote Code Execution
This Metasploit module exploits a PHP function-call injection in SPIPs template engine. The analyseresultatskel function extracts the X-Spip-Filtre: ... patterns from the rendered page body and calls the listed functions as template filters. A newline character is injected into a GET parameter...
CVE-2026-78183
DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quotefloat. quotefloat allocates the length of the string + 1, which is the size of the bare numeric symbol plus NULL. But for special literals NaN, Inf, +Inf, -Inf, Infinity, +Infinity, -Infinity it emits the literal surrounded by...
CVE-2026-77088 justhtml 0.9.0 through 1.21.0 Cross-Site Scripting via code-span
justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in tomarkdown where inline code spans fail to account for blank lines as block boundaries. Attackers can inject blank lines into code or pre element text to break the inline span, causing sanitized HTML to be...
CVE-2026-5389 justhtml before 1.13.0 XSS via code fence breakout
justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the tomarkdown function when serializing attacker-controlled pre content. Attackers can place backticks inside sanitized pre elements to break out of fixed-length code fences, allowing raw HTML to execute when the...
PT-2026-79770
justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the to markdown function when serializing attacker-controlled pre content. Attackers can place backticks inside sanitized pre elements to break out of fixed-length code fences, allowing raw HTML to execute when the...
PT-2026-84878
Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application. The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as...
AZL-97359 CVE-2026-74678 affecting package kernel 6.6.150.1-1
In the Linux kernel, the following vulnerability has been resolved: net: usb: ax88179178a: fix skb leak in ax88179txfixup When the interface has NETIFFSG enabled and skblinearize fails in ax88179txfixup, the function returns NULL without freeing the skb. usbnetstartxmit treats a NULL return from...
GHSA-CV22-G7MW-8V73 NLTK CrubadanCorpusReader path traversal allows arbitrary file disclosure
NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader. loadlangngrams joins the corpus root with crubadancode, the column-0 value read from the corpus table.txt mapping file, and opens the result with the builtin open rather than the pathsec-validated opener, s...
CVE-2026-68767
hashcat's fgetl function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length. Attackers can trigger this out-of-bounds heap write by providing a hash file, potfile, or wordlist containing a line of exactly HCBUFSIZLARGE...
UBUNTU-CVE-2026-68767
hashcat's fgetl function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length. Attackers can trigger this out-of-bounds heap write by providing a hash file, potfile, or wordlist containing a line of exactly HCBUFSIZLARGE...
CVE-2026-68767 hashcat through 7.1.2 Off-by-One Out-of-Bounds Heap Write in fgetl()
hashcat's fgetl function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length. Attackers can trigger this out-of-bounds heap write by providing a hash file, potfile, or wordlist containing a line of exactly HCBUFSIZLARGE...
CVE-2026-68767
hashcat's fgetl function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length. Attackers can trigger this out-of-bounds heap write by providing a hash file, potfile, or wordlist containing a line of exactly HCBUFSIZLARGE...
EUVD-2026-64312
hashcat's fgetl function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length. Attackers can trigger this out-of-bounds heap write by providing a hash file, potfile, or wordlist containing a line of exactly HCBUFSIZLARGE...
CVE-2026-68767 hashcat through 7.1.2 Off-by-One Out-of-Bounds Heap Write in fgetl()
hashcat's fgetl function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length. Attackers can trigger this out-of-bounds heap write by providing a hash file, potfile, or wordlist containing a line of exactly HCBUFSIZLARGE...
DOMPurify: DOMPurify: Cross-site scripting due to state leakage in sanitization.
A flaw was found in DOMPurify. This vulnerability allows a remote attacker to perform cross-site scripting XSS by exploiting a state leakage issue. Specifically, function predicates used for adding attributes or tags during sanitization can persist across multiple calls to the sanitize function...
