21394 matches found
Deserialization of Untrusted Data
Overview azure-ai-language-conversations-authoring is a Microsoft Corporation Azure Ai Language Conversations Authoring Client Library for Python Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the getcontinuationtoken function. An attacker can execute...
Buffer Underwrite (Buffer Underflow)
Overview Affected versions of this package are vulnerable to Buffer Underwrite Buffer Underflow in the sshgethexa function on invalid input. An attacker can cause a buffer underflow and potentially execute arbitrary code or crash the application by supplying specially crafted input. Workaround Th...
CVE-2026-0651
A path traversal vulnerability was identified TP-Link Tapo C260 v1, D235 v1, C211 v2 and C520WS v2.6 within the HTTP server’s handling of GET requests. The server performs path normalization before fully decoding URL encoded input and falls back to using the raw path when normalization fails. An...
CVE-2026-25530
Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, the getSwimlane API method lacks project-level authorization, allowing authenticated users to access swimlane data from projects they cannot access. This vulnerability is fixed in 1.2.50...
UBUNTU-CVE-2026-25530
Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, the getSwimlane API method lacks project-level authorization, allowing authenticated users to access swimlane data from projects they cannot access. This vulnerability is fixed in 1.2.50...
CVE-2026-25530 Kanboard is missing authorization check in getSwimlane API allows cross-project data access
Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, the getSwimlane API method lacks project-level authorization, allowing authenticated users to access swimlane data from projects they cannot access. This vulnerability is fixed in 1.2.50...
CVE-2026-25530 Kanboard is missing authorization check in getSwimlane API allows cross-project data access
Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, the getSwimlane API method lacks project-level authorization, allowing authenticated users to access swimlane data from projects they cannot access. This vulnerability is fixed in 1.2.50...
CVE-2025-15569
A flaw has been found in Artifex MuPDF up to 1.26.1 on Windows. The impacted element is the function getsystemdpi of the file platform/x11/winmain.c. This manipulation causes uncontrolled search path. The attack requires local access. The attack is considered to have high complexity. The...
UBUNTU-CVE-2025-15569
A flaw has been found in Artifex MuPDF up to 1.26.1 on Windows. The impacted element is the function getsystemdpi of the file platform/x11/winmain.c. This manipulation causes uncontrolled search path. The attack requires local access. The attack is considered to have high complexity. The...
CVE-2025-15569
Summary of CVE-2025-15569 (Artifex MuPDF) : A vulnerability affecting MuPDF builds up to 1.26.1 on Windows, caused by the get_system_dpi function in platform/x11/win_main.c, which enables uncontrolled search path manipulation. Exploitation requires local access and is described as high complexity...
CVE-2025-15569 Artifex MuPDF win_main.c get_system_dpi uncontrolled search path
A flaw has been found in Artifex MuPDF up to 1.26.1 on Windows. The impacted element is the function getsystemdpi of the file platform/x11/winmain.c. This manipulation causes uncontrolled search path. The attack requires local access. The attack is considered to have high complexity. The...
OSV-2026-215 UNKNOWN READ in getTypeCacheHashTableBucket
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=482748215 Crash type: UNKNOWN READ Crash state: getTypeCacheHashTableBucket usbd.h...
CVE-2025-70347
An issue in mquickjs before commit 74b7e 2026-01-15 allows a local attacker to cause a denial of service via a crafted file to the getmblocksize function at mquickjs.c...
TP-Link Tapo C260 security vulnerabilities
The TP-Link Tapo C260 is a surveillance camera produced by the TP-Link company. The TP-Link Tapo C260 v1 version has a security vulnerability, which stems from improper handling of specific GET request paths. This vulnerability may lead to unauthorized exploration of file system paths that have n...
gmin_get_config_var Heap Buffer Overflow DoS
The vulnerability of the gmingetconfigvar function in the drivers/staging/media/atomisp/pci/atomispgminplatform.c driver for Intel Atom-based Linux operating systems is related to a buffer overflow based on a stack. Exploiting this vulnerability could allow an attacker to cause a system failure...
PT-2026-7278
Name of the Vulnerable Software and Affected Versions mquickjs versions prior to commit 74b7e 2026-01-15 Description An issue exists in mquickjs that allows a local attacker to cause a denial of service through a crafted file. The issue is related to the get mblock size function located in the...
MicroQuickJS security vulnerability
MicroQuickJS is a JavaScript library developed by Bellard’s individual developers. Versions of MicroQuickJS prior to 2026-01-15 contained security vulnerabilities. These vulnerabilities stemmed from defects in the getmblocksize function, which could lead to denial-of-service attacks...
Artifex MUPDF code issue vulnerability
Artifex MUPDF is a rich-text editor developed by individual developers. Unlike standard text editors, programmers can download free rich-text editors and embed them on their own websites or programs of course, paid versions offer more powerful features. This makes it convenient for users to edit...
Siemens S7-1500 NULL Pointer Dereference (CVE-2025-8224)
A vulnerability has been found in GNU Binutils 2.44 and classified as problematic. This vulnerability affects the function bfdelfgetstrsection of the file bfd/elf.c of the component BFD Library. The manipulation leads to null pointer dereference. Local access is required to approach this attack...