2197 matches found
CVE-2026-97394
kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-www-form-urlencoded or multipart/form-data request bodies,...
EUVD-2026-102143
kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-www-form-urlencoded or multipart/form-data request bodies,...
CVE-2026-0993
SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allows unauthenticated remote attackers to cause a denial of service by sending an oversized boundary value in the Content-Type header of a crafted POST request. Attackers can exploit the embedded HTTP...
CVE-2026-0993 SODOLA SL902-SWTGW124AS Buffer Overflow DoS via Multipart Boundary Parser
SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allows unauthenticated remote attackers to cause a denial of service by sending an oversized boundary value in the Content-Type header of a crafted POST request. Attackers can exploit the embedded HTTP...
EUVD-2026-101803
SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allows unauthenticated remote attackers to cause a denial of service by sending an oversized boundary value in the Content-Type header of a crafted POST request. Attackers can exploit the embedded HTTP...
CVE-2026-0993 SODOLA SL902-SWTGW124AS Buffer Overflow DoS via Multipart Boundary Parser
SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allows unauthenticated remote attackers to cause a denial of service by sending an oversized boundary value in the Content-Type header of a crafted POST request. Attackers can exploit the embedded HTTP...
CVE-2026-0993
The SODOLA SL902-SWTGW124AS device is vulnerable to a buffer overflow in its embedded HTTP server running firmware versions prior to 200.2.12 . An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending a crafted POST request containing an oversized boundary value in the ...
CVE-2026-0993: Buffer Copy without Checking Size of Input
SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allows unauthenticated remote attackers to cause a denial of service by sending an oversized boundary value in the Content-Type header of a crafted POST request. Attackers can exploit the embedded HTTP...
Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Struts
Summary Multiple vulnerabilities were addressed in IBM Library Support for Struts 1.0 Vulnerability Details CVEID:CVE-2005-3745 DESCRIPTION: Cross-site scripting XSS vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML vi...
CVE-2026-107370
When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as query string parameters...
CVE-2026-108705
CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint that allows authenticated users to import data into any custom form by customFormId. Low-privileged attackers can upload Excel files with importType ADD or UPDATE to create records...
EUVD-2026-96703
CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint that allows authenticated users to import data into any custom form by customFormId. Low-privileged attackers can upload Excel files with importType ADD or UPDATE to create records...
CVE-2026-108705
CordysCRM through version 1.9.3 is vulnerable to a missing authorization flaw in the POST /custom-form/data/import endpoint. This vulnerability allows authenticated, low-privileged users to import data into any custom form by specifying a customFormId . Attackers can upload Excel files using impo...
CVE-2026-108705 CordysCRM through 1.9.3 Missing Authorization via /custom-form/data/import
CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint that allows authenticated users to import data into any custom form by customFormId. Low-privileged attackers can upload Excel files with importType ADD or UPDATE to create records...
CVE-2026-108705 CordysCRM through 1.9.3 Missing Authorization via /custom-form/data/import
CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint that allows authenticated users to import data into any custom form by customFormId. Low-privileged attackers can upload Excel files with importType ADD or UPDATE to create records...
CVE-2026-108705: Missing Authorization
CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint that allows authenticated users to import data into any custom form by customFormId. Low-privileged attackers can upload Excel files with importType ADD or UPDATE to create records...
CLEANSTART-2026-VJ23809 multer is a middleware for handling multipart/form-data in Node
Security vulnerability affects the n8n package. multer is a middleware for handling multipart/form-data in Node...
CLEANSTART-2026-SY10703 multer is a middleware for handling multipart/form-data in Node
Security vulnerability affects the n8n package. multer is a middleware for handling multipart/form-data in Node...
CLEANSTART-2026-FL31230 multer is a middleware for handling multipart/form-data in Node
Security vulnerability affects the n8n package. multer is a middleware for handling multipart/form-data in Node...
CVE-2026-48484
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API rpc function in apiblueprint.py handles multipart/form-data uploads by reading the whole content of the uploaded file into memory with file.read. This occurs before the data is sent to the...