20974 matches found
CVE-2026-25882
A flaw was found in Fiber, an Express-inspired web framework for Go. This denial of service DoS vulnerability allows a remote attacker to crash the application. By sending requests to routes containing more than 30 parameters, the attacker can exploit missing validation during route registration...
CVE-2026-27585
A flaw was found in Caddy, an extensible server platform. The path sanitization routine in the file matcher component does not properly sanitize backslashes. This vulnerability can be exploited by users with specific Caddy and environment configurations, potentially leading to the bypass of...
CVE-2026-27117
bit7z is a cross-platform C++ static library that allows the compression/extraction of archive files. Prior to version 4.0.11, a path traversal vulnerability "Zip Slip" exists in bit7z's archive extraction functionality. The library does not adequately validate file paths contained in archive...
CVE-2026-27117 bit7z has a path traversal vulnerability
bit7z is a cross-platform C++ static library that allows the compression/extraction of archive files. Prior to version 4.0.11, a path traversal vulnerability "Zip Slip" exists in bit7z's archive extraction functionality. The library does not adequately validate file paths contained in archive...
CVE-2026-27588
A flaw was found in Caddy's HTTP host request matcher. When Caddy is configured with a large list of host entries, its host matching becomes unexpectedly case-sensitive instead of case-insensitive as documented. A remote attacker can exploit this by altering the casing of the Host header in HTTP...
CVE-2026-27571
A flaw was found in nats-server. The WebSockets implementation fails to enforce a memory allocation limit during the decompression of WebSocket messages. A malicious compressed payload allows an attacker to cause an excessive memory consumption, eventually resulting in a server crash and a comple...
CVE-2026-3105
SummaryThis advisory addresses a SQL injection vulnerability in the API endpoint used for retrieving contact activities. A vulnerability exists in the query construction for the Contact Activity timeline where the parameter responsible for determining the sort direction was not strictly validated...
CVE-2026-27589
A flaw was found in Caddy. The local administration API, when origin enforcement is not enabled, accepts cross-origin requests to its configuration loading endpoint. A remote attacker can exploit this by tricking a victim's browser into sending a malicious JSON configuration. This allows for...
CVE-2026-27587
A flaw was found in Caddy, an extensible server platform. The HTTP path request matcher, intended to be case-insensitive, incorrectly processes percent-escape sequences. This vulnerability allows a remote attacker to bypass path-based routing and associated access controls by manipulating the...
CVE-2026-27590
A flaw was found in Caddy's FastCGI path splitting logic. This vulnerability arises because the system computes the split index on a lowercased copy of the request path, which can be unsafe for Unicode characters. A remote attacker could exploit this by sending a specially crafted request, leadin...
CVE-2026-27586
A flaw was found in Caddy, an extensible server platform. Two errors in the ClientAuthentication.provision function can cause mutual Transport Layer Security mTLS client certificate authentication to silently fail open. This occurs when a Certificate Authority CA certificate file is missing,...
CVE-2026-1229
A flaw was found in the github.com/cloudflare/circl/ecc/p384 package. The CombinedMult function, which is part of the elliptic curve cryptography ECC implementation for the secp384r1 curve, generates an incorrect value when provided with specific inputs. This can lead to incorrect cryptographic...
GHSA-9FWW-8CPR-Q66R Isso affected by Stored XSS via comment website field
Impact This is a stored Cross-Site Scripting XSS vulnerability affecting the website and author comment fields. The website field was HTML-escaped using quote=False, which left single and double quotes unescaped. Since the frontend inserts the website value directly into a single-quoted href...
EUVD-2026-8467
Payload is a free and open source headless content management system. Prior to 3.75.0, a Server-Side Request Forgery SSRF vulnerability exists in Payload's external file upload functionality. When processing external URLs for file uploads, insufficient validation of HTTP redirects could allow an...
CVE-2026-2803
Information disclosure, mitigation bypass in the Settings UI component. This vulnerability was fixed in Firefox 148 and Thunderbird 148...
CVE-2026-2803
Information disclosure, mitigation bypass in the Settings UI component. This vulnerability affects Firefox 148 and Thunderbird 148...
CVE-2026-2784
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8...
CVE-2026-2784
Mitigation bypass in the DOM: Security component. This vulnerability affects Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8...