64579 matches found
CVE-2026-51296
SQLite 3.41 has a use-after-free vulnerability in jsonRemoveFunc of SQLite JSON module. The parsed JSON object is freed at line 3555, while line 3575 still calls jsonLookupStep with the released pointer. Remote attackers can exploit this flaw to crash the service and leak heap memory information...
CVE-2026-59239: Improper Neutralization of Input During Web Page Generation
Stored Cross-site Scripting CWE-79 in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user to execute arbitrary JavaScript in another user's browser, including administrators, leading to session compromise and account takeover, via a payload...
CVE-2026-51296
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
PT-2026-65087
Stored Cross-site Scripting CWE-79 in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user to execute arbitrary JavaScript in another user's browser, including administrators, leading to session compromise and account takeover, via a payload...
CVE-2026-47078: Relative Path Traversal
Relative Path Traversal vulnerability in Erlang OTP stdlib zip module allows writing files outside the intended extraction directory via a crafted zip archive. zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:checkdirlevel/2, which tracks directory depth as a running integer...
Siemens SIMATIC S7-1500 CPU 1518 MFP NULL Pointer Dereference (CVE-2025-23143)
"In the Linux kernel, the following vulnerability has been resolved: net: Fix null-ptr-deref by socklockinitclassandname and rmmod. When I ran the repro 0 and waited a few seconds, I observed two LOCKDEP splats: a warning immediately followed by a null-ptr-deref. 1 Reproduction Steps: 1 Mount CIF...
Linux Distros Unpatched Vulnerability : CVE-2026-64231
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/msm/dsi: don't dump registers past the mapped region On DSI 6G platforms the IO address space is internally adjusted by iooffset. Later this adjusted addres...
nginx 1.30.x < 1.30.4 / 1.31.2 < 1.31.3 Multiple Vulnerabilities
According to its Server response header, the installed version of nginx is 1.30.0 prior to 1.30.4, or 1.31.2 prior to 1.31.3. It is, therefore, affected by multiple vulnerabilities: - A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string...
SUSE CVE-2026-50243
In NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when Unbound is configured with the 'respip' module in front of the validator together with a 'response-ip' redirect rule or an RPZ file with an RPZ-IP trigger, the rewriting handler does not check the security status of the upstream answer...
nginx: NGINX: Heap buffer over-read allows memory modification or denial of service
A vulnerability in NGINX's ngxhttpssimodule allows an unauthenticated MITM attacker to trigger a heap buffer over-read by manipulating upstream server responses. This requires SSI, proxypass, and proxybuffering off to be configured, and can result in memory modification or a Denial of Service DoS...
nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module
A vulnerability in the NGINX ngxhttpslicemodule allows remote, unauthenticated attackers to access uninitialized memory via crafted requests. If configured with unnamed regex captures or background cache updates, this flaw can result in limited memory disclosure or a denial-of-service crash...
Input: elan_i2c - prevent division by zero and arithmetic underflow
...
netfilter: ebtables: module names must be null-terminated
...
crypto: drbg - Fix returning success on failure in CTR_DRBG
...
crypto: caam - use print_hex_dump_devel to guard key hex dumps
...
CVE-2026-17433
CVE-2026-17433 affects nanocoai NanoClaw up to v2.0.64 in MCP Server Approval, specifically the createChatSdkBridge.setup function in src/channels/chat-sdk-bridge.ts. Root cause: improper authorization due to manipulation of the function. Local attack vector; exploit publicly available. The provi...
[SECURITY] Fedora 43 Update: p11-kit-0.26.4-1.fc43
p11-kit provides a way to load and enumerate PKCS11 modules, as well as a standard configuration setup for installing PKCS11 modules in such a way that they're discoverable...
Linux Distros Unpatched Vulnerability : CVE-2025-71408
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NLTK Natural Language Toolkit before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls...
SUSE CVE-2026-64297
In the Linux kernel, the following vulnerability has been resolved: module: decompress: check return value of moduleextendmaxpages moduleextendmaxpages calls kvrealloc internally and returns -ENOMEM on allocation failure. The return value is never checked. If the initial allocation fails,...