22723 matches found
ROOT-OS-DEBIAN-12-CVE-2024-26661 CVE-2024-26661 in linux - Patched by Root
Root has patched CVE-2024-26661 in the linux package for Root:Debian:12. Multiple fixed versions available...
CVE-2026-8470
IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from user secrets under 32 characters. The deterministic Mersenne Twister PRNG produces identical keys for...
CVE-2026-20200
creationtimestamp| type| source ---|---|--- 2026-08-05 17:00:05+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/96776 2026-08-06 00:00:33+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/96776 2026-08-06 10:50:29+00:00| seen|...
CVE-2026-71264
WLED's GET /json/cfg endpoint registered in wled00/wledserver.cpp calls serveJson with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration network, hardware, LED setup to any unauthenticated client on the network...
CVE-2026-15210
The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeri...
CVE-2026-15210 Login/Signup with Phone Number, OTP Verification < 1.8.71 - Unauthenticated Account Takeover via OTP Brute Force
The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeri...
CVE-2020-9676
creationtimestamp| type| source ---|---|--- 2026-08-05 05:00:04+00:00| seen| https://t.me/timcorehacking/946 2026-08-06 00:00:55+00:00| seen| https://t.me/timcorehacking/946...
CGA-8985-4VGP-GR5V
Bulletin has no description...
CVE-2026-67592
creationtimestamp| type| source ---|---|--- 2026-08-04 20:12:38+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/7p5nbufssz34w...
CVE-2026-67590
creationtimestamp| type| source ---|---|--- 2026-08-04 20:00:41+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3xxd5lc2zvh3f...
CVE-2026-68494
The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength into a new setIntLength helper and invoked it...
CVE-2026-18401
The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length,...
CVE-2026-24083 Untrusted Pointer Dereference in Automotive Security
Memory Corruption while processing IOCTL device driver requests with invalid arguments...
CVE-2026-68494
This CVE notes an incomplete fix for CVE-2026-18401 in jackson-core’s non-blocking parser, leaving a remaining bypass for number-length constraints when data is streamed in many small chunks. The issue arises in the async parser path (MINOR_NUMBER_INTEGER_DIGITS) where validateIntegerLength() is ...
EUVD-2026-52703
The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength into a new setIntLength helper and invoked it...
CVE-2026-68494 jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)
The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength into a new setIntLength helper and invoked it...
CVE-2026-68494 jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)
The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength into a new setIntLength helper and invoked it...
CVE-2026-68494
The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength into a new setIntLength helper and invoked it...
CVE-2026-68494 jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)
The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength into a new setIntLength helper and invoked it...
EUVD-2026-52699
The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length,...