66493 matches found
net/mail: golang: net/mail: Denial of Service via pathological email address parsing
A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...
brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function
A flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand function, which can lead to excessive memory consumption. This can cause a denial of service DoS by crashing the application due to an out-of-memory error...
python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory
A flaw was found in the tarfile.extractall function within Python. A remote attacker could exploit this vulnerability by providing a specially crafted archive. This archive could bypass security filters by using a hardlink that references a symlink, allowing the symlink to be recreated outside th...
CVE-2026-86515
vgmstream up to r2117 is affected by a vulnerability in the txtp parser component, specifically the add_entry function in src/meta/txtp_parser.c. Manipulation of the range_start/range_end arguments leads to resource consumption , resulting in a low availability impact. The attack is remote over t...
CVE-2026-86515 vgmstream txtp txtp_parser.c add_entry resource consumption
A security vulnerability has been detected in vgmstream up to r2117. Impacted is the function addentry of the file src/meta/txtpparser.c of the component txtp. Such manipulation of the argument rangestart/rangeend leads to resource consumption. The attack may be performed from remote. The exploit...
CLEANSTART-2026-PE88816 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label
Multiple security vulnerabilities affect the helm-operator package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...
EUVD-2026-74266
An issue in OpenDDS 3.33.x allows a local attacker to cause a denial of service via the verify function in the SIgnedDocument module...
PT-2026-88319
A weakness has been identified in opengeos GeoLibre up to 2.3.0. Impacted is the function is within roots. This manipulation causes server-side request forgery. The attack can be initiated remotely. Upgrading to version 2.4.0 is recommended to address this issue. Patch name:...
CVE-2026-78624: Improper Limitation of a Pathname to a Restricted Directory
The Okta Access Gateway backup restore function does not validate the filename embedded in an encrypted backup payload. This results in writing file contents to unintended locations on the appliance filesystem...
CVE-2026-52486: Improper Verification of Cryptographic Signature
An issue in OpenDDS 3.33.x allows a local attacker to cause a denial of service via the verify function in the SIgnedDocument module...
EUVD-2026-72778
An issue in the btmaclhandle function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows attackers to cause a Denial of Service DoS via sending a crafted L2CAP packet...
PT-2026-87913
Missing authentication for critical function in Windows Autopilot allows an authorized attacker to perform tampering locally...
PT-2026-87185
A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.15. The impacted element is the function uploadFile of the file controllers/pic.php. Such manipulation of the argument outerSrc/selectPhoto leads to cross site scripting. The attack may be performed from remote. The...
CVE-2026-50349: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally...
CVE-2026-70342: Use After Free
Use after free in Windows Ancillary Function Driver for WinSock allows an unauthorized attacker to elevate privileges over a network...
ROS-20260908-73-0097
The vulnerability in Vim relates to the execution of functions from an unverified and uncontrolled area. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
PT-2026-88338
An issue in OpenDDS 3.33.x allows a local attacker to cause a denial of service via the verify function in the SIgnedDocument module...
PT-2026-87563
Missing authentication for critical function in Microsoft Windows Search Component allows an authorized attacker to perform tampering locally...
EulerOS 2.0 SP12 : lxc (EulerOS-SA-2026-3282)
According to the versions of the lxc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : lxc is a Linux container runtime. In the setuid helper lxc-user-nic, the delete path contains a logic flaw in the findline function that allows an...
