29948 matches found
CVE-2026-48988
A flaw was found in markdown-it, a Markdown parser. A remote attacker could exploit this vulnerability to cause a Denial of Service DoS when the typographer option is enabled. This occurs due to inefficient processing of smartquotes, leading to excessive CPU consumption when parsing specially...
CVE-2026-82880
YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearch parsers that fail to disable external entity resolution. Attackers can publish malicious documents with DOCTYPE declarations containing SYSTEM entities pointing to local files...
CVE-2026-74866
A flaw was found in @fastify/busboy, a Node.js multipart form-data parser. The parser incorrectly handles lone carriage return or line feed characters in multipart part headers, treating them as part of the filename or field name rather than as line breaks. A remote attacker could exploit this by...
CVE-2026-82880
YaCy Search Server through 1.941 is affected by an XML External Entity (XXE) injection vulnerability in its SVG , FreeMind , and OpenSearch parsers, which fail to disable external entity resolution. An unauthenticated remote attacker can publish a malicious document containing a DOCTYPE declarati...
CVE-2026-82880 YaCy Search Server through 1.941 XML External Entity Injection via Parsers
YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearch parsers that fail to disable external entity resolution. Attackers can publish malicious documents with DOCTYPE declarations containing SYSTEM entities pointing to local files...
CVE-2026-82880 YaCy Search Server through 1.941 XML External Entity Injection via Parsers
YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearch parsers that fail to disable external entity resolution. Attackers can publish malicious documents with DOCTYPE declarations containing SYSTEM entities pointing to local files...
CVE-2026-82880 YaCy Search Server through 1.941 XML External Entity Injection via Parsers
YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearch parsers that fail to disable external entity resolution. Attackers can publish malicious documents with DOCTYPE declarations containing SYSTEM entities pointing to local files...
EUVD-2026-68466
YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearch parsers that fail to disable external entity resolution. Attackers can publish malicious documents with DOCTYPE declarations containing SYSTEM entities pointing to local files...
RHSA-2026:61247 Red Hat Security Advisory: libxml2 security update
Bulletin has no description...
CVE-2026-65315
A flaw was found in Ollama. A remote attacker can exploit an uncontrolled memory allocation vulnerability in the GGUF metadata parser. By supplying a specially crafted GGUF file, an attacker can manipulate length and count fields, leading to excessive memory allocation. This can cause the server ...
FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files
A flaw in FreeRDP's file parser incorrectly treats lines starting with a forward slash / as command-line options. If a victim opens a maliciously crafted .rdp file, an attacker can silently inject CLI flags to execute arbitrary code, expose local filesystems, or bypass certificate validation...
FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files
A flaw in FreeRDP's file parser incorrectly treats lines starting with a forward slash / as command-line options. If a victim opens a maliciously crafted .rdp file, an attacker can silently inject CLI flags to execute arbitrary code, expose local filesystems, or bypass certificate validation...
Important: freerdp
Issue Overview: FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands...
Important: clamav1.4
Issue Overview: A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for...
Important: clamav1.4
Issue Overview: A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for...
PT-2026-83971
Name of the Vulnerable Software and Affected Versions GDB affected versions not specified Description A flaw exists in the STABS debug format parser within the read member functions function in gdb/stabsread.c. The issue stems from a linked list removal bug during the separation of destructor and...
PT-2026-89662
A flaw was found in GDB's STABS debug format parser. The read member functions function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in the main...
PT-2026-83982
Name of the Vulnerable Software and Affected Versions Livewire versions 3.0.0-beta.1 through 3.8.2 Livewire versions 4.0.0 through 4.3.3 Description The dot-notated query-string parser in js/plugins/history/index.js, specifically within the fromQueryString and insertDotNotatedValueIntoData...
PT-2026-89661
A flaw was found in GDB's STABS debug format parser. The read member functions function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in the main...
PT-2026-83784
YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearch parsers that fail to disable external entity resolution. Attackers can publish malicious documents with DOCTYPE declarations containing SYSTEM entities pointing to local files...