EUVD-2026-67207

A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of...

Cross-tenant database retargeting via dot/NUL injection in namespace strings in libmongocrypt

A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of...

CVE-2026-81523 Cross-tenant database retargeting via dot/NUL injection in namespace strings in libmongocrypt

A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of...

EUVD-2026-67206

A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed at a different...

CVE-2025-45960

CVE-2025-45960 - tawk.to Live chat - 1.6.1 - Cross-Site-Scripting XSS-Schwachstelle Bestätigt auf 1.6.1 ältere Versionen sind wahrscheinlich betroffen Beschreibung: Es wurde festgestellt, dass die Webanwendung vom Benutzer bereitgestellte Eingaben ohne ordnungsgemäße Eingabevalidierung oder...

EUVD-2026-67199

DeadLetterPublishingRecovererFactory reads the retrytopic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigIntegerheader.value with no length or format validation. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for...

CVE-2026-76220

A flaw was found in GitPython. A remote attacker can bypass the checkunsafeoptions guard by combining a single-character keyword argument with splitsinglecharoptions=False. This allows the attacker to supply a crafted dictionary of keyword arguments to guarded methods, such as clonefrom, leading ...

CVE-2026-76217

A flaw was found in GitPython where it fails to properly validate options provided to its git rm and git checkout commands. A remote attacker with low privileges could exploit this by supplying crafted parameters, such as --pathspec-from-file and --pathspec-file-nul. This vulnerability allows for...

CVE-2026-30064

Improper input validation in the buildFilter function processor/processor.go of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-30068

Improper input validation in the HandleUpdate function /sbi/parameterprovision.go of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-30058

Improper Input Validation in the HTTPModifySubscription handler of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2025-12758

CVE-2025-12758: Обход Unicode Variation Selector в функции isLength библиотеки Validator.js CVE ID: CVE-2025-12758 CVSS Score: 8.7 HIGH Уровень опасности: HIGH CWE: CWE-792 Incomplete Filtering of One or More Instances of Special Elements Опубликован: November 26, 2025 Раскрыт: October 19, 2025...

CVE-2022-24086-RCE

CVE-2022-24086-RCE CVE-2022-24086 RCE Description Le versioni di Adobe Commerce 2.4.3-p1 e precedenti e 2.3.7-p2 e precedenti sono interessate da una vulnerabilità di convalida dell'input impropria durante il processo di checkout. Lo sfruttamento di questo problema non richiede l'interazione...

CVE-2026-81693 openssl_encrypt before 1.4.9 Denial of Service via QR total field

opensslencrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions...

EUVD-2026-67049

opensslencrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions...

CVE-2024-34693

CVE-2024-34693: Lettura Arbitraria di File dal Server in Apache Superset Vulnerabilità di convalida impropria dell'input in Apache Superset che consente a un attaccante autenticato di creare una connessione MariaDB con localinfile abilitato. Abilitando localinfile nel client MySQL/MariaDB di...

CVE-2026-33147

CVE-2026-33147 CVE-2026-33147 Stack-based Buffer Overflow in gmtremotedatasetid Riepilogo È stata identificata una vulnerabilità di buffer overflow basato su stack nella funzione gmtremotedatasetid all'interno di src/gmtremote.c. Il problema si verifica quando una stringa lunga appositamente...

CVE-2025-60787

CVE-2025-60787 CVE-2025-60787 Poc - RCE - MotionEye = 0.43.1b4 Link originale: https://github.com/prabhatverma47/motionEye-RCE-through-config-parameter MotionEye RCE tramite bypass della validazione lato client Riepilogo Durante il test di sicurezza di un'istanza MotionEye in esecuzione in Docker...

CVE-2026-29598

CVE-2026-29598: Cross-Site Scripting XSS persistente in cm3 Acora CMS versione 10.7.1. DDSN Interactive cm3 Acora CMS versione 10.7.1 contiene una vulnerabilità di Cross-Site Scripting XSS persistente nella funzionalità di gestione degli utenti. Un amministratore con la possibilità di aggiungere ...

CVE-2026-80545

A flaw was found in the Linux kernel's s390/zcrypt component. This vulnerability stems from insufficient input validation in the xcrbmsgtotype6ep11cprbmsgx function when handling EP11 Cryptographic Coprocessor Request Block CPRB messages. A local attacker could exploit this by crafting a maliciou...