77100 matches found
CVE-2026-54085 Wazuh: Missing input validation in multiple active response scripts allows argument injection
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.2.0 through 4.14.6, multiple active response scripts pass attacker-influenced alert fields to privileged system commands without validating their format, allowing...
CVE-2020-25478--ASUS-RT-AC87U-TFTP-is-vulnerable-to-Denial-of-Service-DoS-attack
ASUS-RT-AC87U-TFTP-è-vulnerabile-ad-attacco-Denial-of-Service-DoS CVE-2020-25478 - Il TFTP di ASUS RT-AC87U è vulnerabile ad un attacco Denial of Service DoS 1. NOME DEL PRODOTTO/I AFFETTO/I E DELLA VERSIONE/E ASUS RT-AC87U 3.0.0.4.38251640 2. TIPO DI PROBLEMA È principalmente correlato a CWE-20,...
DEBIAN-CVE-2026-81523
A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of...
CVE-2026-81523
A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of...
CVE-2026-59317
DeadLetterPublishingRecovererFactory reads the retrytopic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigIntegerheader.value with no length or format validation. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for...
CVE-2026-35869
A Command Injection vulnerability exists in the bsSetLimitCliinfo function within the libshare.so library of LB-link Router AC450M V4.0.0. This flaw occurs due to insufficient validation and sanitization of user-supplied input before it is passed to a system-level command execution context. An...
Blackash-CVE-2025-20393
🛡️ CVE-2025-20393 – Kritische Cisco AsyncOS Schwachstelle 🔍 Überblick CVE‑2025‑20393 ist eine kritische Remotecodeausführung RCE ‑Schwachstelle in Cisco AsyncOS Software , die folgende Geräte betrifft: Cisco Secure Email Gateway physisch & virtuell Cisco Secure Email and Web Manager physisch &...
EUVD-2026-67208
A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application that incorporates untrusted input into these name components can have...
EUVD-2026-67207
A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of...
CVE-2026-81523 Cross-tenant database retargeting via dot/NUL injection in namespace strings in libmongocrypt
A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of...
Cross-tenant database retargeting via dot/NUL injection in namespace strings in libmongocrypt
A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of...
EUVD-2026-67206
A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed at a different...
CVE-2025-45960
CVE-2025-45960 - tawk.to Live chat - 1.6.1 - Cross-Site-Scripting XSS-Schwachstelle Bestätigt auf 1.6.1 ältere Versionen sind wahrscheinlich betroffen Beschreibung: Es wurde festgestellt, dass die Webanwendung vom Benutzer bereitgestellte Eingaben ohne ordnungsgemäße Eingabevalidierung oder...
EUVD-2026-67199
DeadLetterPublishingRecovererFactory reads the retrytopic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigIntegerheader.value with no length or format validation. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for...
CVE-2026-76220
A flaw was found in GitPython. A remote attacker can bypass the checkunsafeoptions guard by combining a single-character keyword argument with splitsinglecharoptions=False. This allows the attacker to supply a crafted dictionary of keyword arguments to guarded methods, such as clonefrom, leading ...
CVE-2025-47812
CVE-2025-47812 Validação de entrada inadequada levou à execução remota de código até o comprometimento total do sistema 📘 Introdução: Julien Ahrens, da RCE Security, descobriu uma vulnerabilidade de segurança crítica que afeta o WingFTP. Registrada como CVE-2025-47812, a vulnerabilidade possui...
CVE-2026-76217
A flaw was found in GitPython where it fails to properly validate options provided to its git rm and git checkout commands. A remote attacker with low privileges could exploit this by supplying crafted parameters, such as --pathspec-from-file and --pathspec-file-nul. This vulnerability allows for...
CVE-2026-30064
Improper input validation in the buildFilter function processor/processor.go of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...