1142 matches found
CVE-2026-15830 Potential denial-of-service vulnerability via nested geometry collections
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's django.contrib.gis.geos.GEOSGeometry is subject to a potential denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text WKT, well-known binary WKB, or hex-encoded WKB,...
EUVD-2026-52748
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.utils.translation.checkforlanguage is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory...
CLSA-2026-1775781159 TuxCare security update for org.springframework (3 CVEs)
TuxCare rebuilt 23 org.springframework packages to address 3 CVEs. Fixed in 5.2.13.RELEASE-tuxcare.3...
MINI-CQJQ-525Q-2XRF
Bulletin has no description...
Malicious code in internallib_v524 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eba59f6d895fdeae2b83c62331fbb87118aa51202fd30ddc351fa43276408a44 The package's main module exports a function command that invokes /bin/bash -c to fetch a script from reverse-shell.sh and pipe it into sh, connectin...
CVE-2026-16614 GSheetConnector <= 5.2.1 - Authenticated (Administrator+) SQL Injection via 's' Parameter
The GSheetConnector – CF7 Google Sheets Connector with Real-Time Sync plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 5.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
CVE-2026-14483
The Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 5.2.0 via the upload function. This is due to missing file type validation in the upload function, combined with a publicly accessible I/O endpoint...
CLEANSTART-2026-VF32547 Security fixes in prometheus 3.5.2:r0
Package prometheus version 3.5.2:r0 fixes 6 vulnerabilities: ghsa-p77j-4mvh-x3m3, ghsa-w8rr-5gcm-pp58, ghsa-hfvc-g4fc-pqhx, CVE-2026-39882, CVE-2026-39883...
EUVD-2026-50973
When enabling Spring Boot DevTools support for a remote application target for example a Docker container or Cloud Foundry app from the Spring Tools Boot Dashboard, Spring Tools generates a shared secret that authenticates DevTools remote-restart uploads to the deployed application. This secret w...
PT-2026-66405
Name of the Vulnerable Software and Affected Versions Spring Tools for Eclipse versions prior to 5.2.1 Description The Boot Dashboard Docker integration publishes container control ports on all host network interfaces 0.0.0.0 instead of restricting them to the loopback interface. This configurati...
CVE-2026-66437
Contributor Server Side Request Forgery SSRF in Feedzy = 5.2.4 versions...
CVE-2026-66437
Contributor Server Side Request Forgery SSRF in Feedzy = 5.2.4 versions...
Fedora 43 : python-django5 (2026-fbb9501b22)
The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-fbb9501b22 advisory. Update python-django5 to version 5.2.16 Fixes three low-severity CVEs - CVE-2026-48588: Potential exposure of private data via cached Set-Cookie...
NPM: js-yaml: Exponential parsing time in flow collections leads to denial of service
NPM: js-yaml: Exponential parsing time in flow collections leads to denial of service vulnerability discovered by ? in WordPress Npm js-yaml versions = 5.0.0, = 5.2.1...
CVE-2026-65474
Unauthenticated Sensitive Data Exposure in Ninja Tables = 5.2.10 versions...
Plone 5.2.x < 5.2.14 / 6.0.x < 6.0.7 Multiple Vulnerabilities (HF 20230921)
The version of Plone installed on the remote host is 5.2.x prior to 5.2.14 or 6.0.x prior to 6.0.7. It is, therefore, affected by the following vulnerabilities: - plone.namedfile has a stored cross-site scripting vulnerability for SVG images. CVE-2023-41048 - When the ++api++ traverser in...
EUVD-2026-42321
linkify-it: Quadratic-complexity DoS via the mailto: validator scan-loop on attacker text...
phpmailer_5.2.16_exploit-
No d...