199 matches found
ColdFusionPwn
ColdFusionPwn Exploitation Tool for CVE-2017-3066 targeting Adobe Coldfusion 11/12. Description The tool allows you to generate serialized AMF-payloads to exploit the missing input validation of allowed classes. For details see our blog post. Install Get the latest version of ysoserial. Get...
The vulnerability of the mxuport_calc_num_ports() function in the drivers/usb/serial/mxuport.c module of the Linux operating system’s USB device driver framework allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the mxuportcalcnumports function in the drivers/usb/serial/mxuport.c module of the Linux device driver framework is related to the copying of buffers without checking input data. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrit...
free5GC NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints
Summary free5GC NRF Docker image free5gc-fuzz:latest accepts NF registration requests without validating any field constraints against 3GPP TS 29.510, allowing unauthenticated attackers to inject fake NF profiles with arbitrary service endpoint IP addresses. All 17 constraint violations tested UU...
UBUNTU-CVE-2026-81523
A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of...
CVE-2026-81523
A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of...
SUSE CVE-2026-80573
In the Linux kernel, the following vulnerability has been resolved: Input: iforce - validate input packet lengths iforceprocesspacket reads fixed fields from joystick, wheel and status packets without first checking their lengths. In particular, the shared hats-and-buttons helper unconditionally...
UBUNTU-CVE-2026-80576
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject oversized IBs with per-ring packet limits On GFX rings, amdgpucsp2ib passed user-supplied ibbytes through to ib-lengthdw without a limit, while ringemitib encodes length into packet fields. Oversized values can...
CVE-2026-80576
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject oversized IBs with per-ring packet limits On GFX rings, amdgpucsp2ib passed user-supplied ibbytes through to ib-lengthdw without a limit, while ringemitib encodes length into packet fields. Oversized values can...
CVE-2026-13215
The Zephyr ext2 filesystem driver fails to validate the slogblocksize field of the on-disk superblock when mounting a filesystem. ext2verifydisksuperblock in subsys/fs/ext2/ext2impl.c checks the magic number, revision, inode size and group counts, but never bounds slogblocksize. On a successful...
EUVD-2026-62969
In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored da...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099502)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099502 advisory. Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the operati...
The vulnerability in the `arch/arm64/kernel/hibernate.c` component of the Linux operating system allows a hacker to trigger a service failure.
The vulnerability in the arch/arm64/kernel/hibernate.c component of the Linux operating system relates to the copying of buffers without checking the input data. Exploiting this vulnerability can allow an attacker to cause a service failure...
CVE-2026-18952 Missing Input Validation in Threat Intel Feed Parser in OpenSearch Security Analytics Plugin
Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform server-side request forgery and read local files via a crafted URL parameter to the threat intel source configuration endpoint...
ROS-20260812-73-0029
The vulnerability in Wireshark is related to the lack of checks on input data for cyclic operations. Exploiting this vulnerability can allow a hacker to cause a service failure...
CVE-2026-62433
Parts of the DMOP handling code assumes the caller has provided the required number of buffers for the given operation without any checking being done. As a result, certain operations might access stack rubble as structures are possibly uninitialized...
EUVD-2026-38507
A missing validation of user input when saving delivery limitations in Revive Adserver 6.0.6 and earlier could allow a low‑privileged user to use the logical parameter to inject malicious PHP code into the compiledlimitations field on the database and have it executed during banner delivery. Inpu...
CVE-2026-9255
Missing input source validation in the tool authorization prompt in Kiro CLI before 1.28.0 allows a local attacker to execute arbitrary tools, including shell commands, without user approval by crafting content that is piped to kiro-cli via stdin. We recommend you to upgrade to kiro-cli version...
CVE-2026-37460
Missing input validation in the rfapiRibBi2Ri function rfapirib.c of FRRouting FRR stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service DoS via supplying a crafted BGP UPDATE message...
CVE-2026-37460
CVE-2026-37460 affects FRRouting (FRR) stable/10.0–10.6. The issue is in the rfapiRibBi2Ri() function (rfapi_rib.c) where missing input validation can be triggered by a crafted BGP UPDATE message, leading to Denial of Service. Connected sources consistently describe the same flaw and affected ran...
