1339 matches found
CVE-2026-109380 modern-tar 0.3.5 through 0.8.5 Memory Exhaustion via Malformed Octal Size Field
modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal. Attackers can supply a crafted, optionally gzip-compressed, archive to unpackTar that buffers chunks indefinitely, exhausting...
CVE-2026-109380
The modern-tar library (versions 0.3.5 through 0.8.5) is vulnerable to a memory exhaustion Denial of Service (DoS) condition. The root cause lies in the readOctal() function, which fails to properly validate non-octal bytes, allowing an attacker to produce negative entry sizes . By providing a sp...
WordPress Modern Events Calendar Lite plugin < 7.37.0 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Aarush Gaur in WordPress Plugin Modern Events Calendar Lite versions 7.37.0...
CVE-2026-109380: Improper Validation of Specified Quantity in Input
modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal. Attackers can supply a crafted, optionally gzip-compressed, archive to unpackTar that buffers chunks indefinitely, exhausting...
PT-2026-110929
🚨 CVE-2026-109380 modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal. Attackers can supply a crafted, optionally gzip-compressed, archive to unpackTar that buffers chunks...
kiterunner
Kiterunner Introducción Durante mucho tiempo, el descubrimiento de contenido se ha centrado en encontrar archivos y carpetas. Si bien este enfoque es efectivo para servidores web heredados que alojan archivos estáticos o responden con 3xx ante una ruta parcial, ya no es efectivo para aplicaciones...
ModernExecServer DLL Heap Buffer Overflow Privilege Escalation
The vulnerability of the ModernExecServer.dll library of the Modern Execution Server operating system is related to the use of memory after release. Exploiting this vulnerability can allow an attacker to increase their privileges...
CVE-2026-93642 Zimbra Collaboration Suite Modern Web Client Stored Cross-Site Scripting via Forged Share Invitation
An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim...
CVE-2026-93642
The Zimbra Collaboration Suite Modern Web Client is vulnerable to Stored Cross-Site Scripting (XSS) due to a flaw where an unauthenticated sender can forge a share notification. When a signed-in Zimbra Modern recipient clicks the Accept Share button, the XSS is triggered. This allows an attacker ...
CVE-2026-93642: Improper Neutralization of Input During Web Page Generation
An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim...
Astra Linux – Vulnerability in freerdp2
FreeRDP is a free implementation of the Remote Desktop Protocol. Clients that use the /bpp:32 legacy GDI drawing path with a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read vulnerabilities. Versions 3.5.0 and 2.11.6 address this issue. As a workaround, use modern...
CVE-2026-73022
Use after free in Windows Modern Device Management MDM allows an authorized attacker to elevate privileges locally...
CVE-2026-73003
Use after free in Windows Modern Device Management MDM allows an authorized attacker to elevate privileges locally...
CVE-2026-72963
Use after free in Windows Modern Execution Server allows an authorized attacker to elevate privileges locally...
EUVD-2026-73654
Use after free in Windows Modern Device Management MDM allows an authorized attacker to elevate privileges locally...
EUVD-2026-73117
Use after free in Windows Modern Execution Server allows an authorized attacker to elevate privileges locally...
CVE-2026-72963
CVE-2026-72963 is a use-after-free vulnerability in Windows Modern Execution Server that allows an authorized attacker to achieve local privilege escalation . The CVSS v3.1 score is 7.0 (HIGH) , with a local attack vector, high complexity, low privileges required, and high impact on confidentiali...
CVE-2026-69377
CVE-2026-69377 affects Windows Modern Device Management (MDM) , where a missing authorization check allows a low-privileged local attacker to escalate privileges with high impact on confidentiality, integrity, and availability. The assigned CVSS 3.1 score is 7.8 (HIGH) with the vector AV:L/AC:L/P...
