161 matches found
CVE-2026-119649
Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete other users' media items by content id and...
CVE-2026-119649 Orchard CMS 1.10.3 through 1.11 Improper Authorization via Media Library Folder Permission Check
Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete other users' media items by content id and...
CVE-2026-119649
Orchard CMS versions 1.10.3 through 1.11 are vulnerable to an improper authorization flaw within the MediaLibraryService.CheckMediaFolderPermission() method. This vulnerability allows authenticated users with Author or Contributor roles to bypass permission checks and access media belonging to ot...
EUVD-2026-114065
Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete other users' media items by content id and...
CVE-2026-119649 Orchard CMS 1.10.3 through 1.11 Improper Authorization via Media Library Folder Permission Check
Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete other users' media items by content id and...
PT-2026-133579
Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete other users' media items by content id and...
CVE-2026-119649: OrchardCMS Orchard: Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in…
Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete other users' media items by content id and...
CVE-2026-109363
ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus branch ID, but the size computation during UnminedTx construction treats re-serialization of the Orchard bundle as infallible, so the resulting error trips an expect that aborts zebrad...
CVE-2026-109365
Zebra versions before 6.4.0 are vulnerable to an uncontrolled resource consumption vulnerability. This allows unauthenticated peers to force full proof verification by serving forged block bodies with valid header hashes. Attackers can flip authorizing-only bytes, such as a coinbase scriptSig , t...
CVE-2026-109365 Zebra before 6.4.0 Denial of Service via Same-Hash Forged Block Bodies
Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated peers to force full proof verification by serving forged block bodies with valid header hashes. Attackers can flip authorizing-only bytes such as a coinbase scriptSig, wasting Sapling,...
EUVD-2026-97665
ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus branch ID, but the size computation during UnminedTx construction treats re-serialization of the Orchard bundle as infallible, so the resulting error trips an expect that aborts zebrad...
CVE-2026-109363 Zebra 6.4.0 before 6.4.2 Denial of Service via Malformed v6 Transaction
ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus branch ID, but the size computation during UnminedTx construction treats re-serialization of the Orchard bundle as infallible, so the resulting error trips an expect that aborts zebrad...
CVE-2026-109363
ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus branch ID, but the size computation during UnminedTx construction treats re-serialization of the Orchard bundle as infallible, so the resulting error trips an expect that aborts zebrad...
PT-2026-110780
Name of the Vulnerable Software and Affected Versions ZcashFoundation Zebra versions 6.4.0 through 6.4.1 Description The software incorrectly parses version 6 transactions that carry a pre-NU6.3 consensus branch ID. During the construction of UnminedTx, the size computation assumes that the...
CVE-2026-109363: Reachable Assertion
ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus branch ID, but the size computation during UnminedTx construction treats re-serialization of the Orchard bundle as infallible, so the resulting error trips an expect that aborts zebrad...
CVE-2026-104425
ZcashFoundation Zebra before 6.1.0 contains a resource exhaustion vulnerability that allows unauthenticated peers to degrade block processing by pushing transactions with invalid Orchard proofs without being misbehavior-scored. Attackers can repeatedly push invalid proofs into the shared halo2...
EUVD-2026-91436
ZcashFoundation Zebra before 6.1.0 contains a resource exhaustion vulnerability that allows unauthenticated peers to degrade block processing by pushing transactions with invalid Orchard proofs without being misbehavior-scored. Attackers can repeatedly push invalid proofs into the shared halo2...
CVE-2026-104425
ZcashFoundation Zebra versions before 6.1.0 are susceptible to a resource exhaustion vulnerability. Unauthenticated peers can degrade block processing by pushing transactions containing invalid Orchard proofs without being misbehavior-scored. By repeatedly pushing these invalid proofs into the sh...
CVE-2026-104425 Zebra before 6.1.0 Batch-Verification Poisoning DoS via Unattributed Pushed Transactions
ZcashFoundation Zebra before 6.1.0 contains a resource exhaustion vulnerability that allows unauthenticated peers to degrade block processing by pushing transactions with invalid Orchard proofs without being misbehavior-scored. Attackers can repeatedly push invalid proofs into the shared halo2...
CVE-2026-104425
ZcashFoundation Zebra before 6.1.0 contains a resource exhaustion vulnerability that allows unauthenticated peers to degrade block processing by pushing transactions with invalid Orchard proofs without being misbehavior-scored. Attackers can repeatedly push invalid proofs into the shared halo2...