6448 matches found
CVE-2026-33327
libvips is a fast image processing library with low memory needs. The vipsload operation in versions before and including 8.18.0 could incorrectly determine image dimensions leading to an integer overflow and a subsequent heap-based buffer overflow. This has been patched in version 8.18.1...
CVE-2026-55626
xrdp is an open source RDP server. In versions 0.10.6 and prior, when an authenticated user session is initialized using the Xvnc backend over UNIX domain sockets, the Xvnc process is launched with insufficient authentication mechanisms. A local authenticated attacker could exploit this...
CVE-2026-39878
Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration form that allows any unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser session, leading to full platform admin account takeover. This has been...
CVE-2026-46701 Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.4.5, the MCP SSE server defaults to an empty secret process.env'NETWORKAIMCPSECRET' ?? '' at bin/mcp-server.ts:89, which causes isAuthorized lib/mcp-transport-sse.ts:254 to return true unconditionally for every reques...
CVE-2026-35590
libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was not verifying the range of EXIF tag groups before passing data to libexif, leading to a possible null pointer dereference and crash. This has been patched in...
CVE-2026-33327 Possible integer overflow leading to potential heap-based buffer overflow
libvips is a fast image processing library with low memory needs. The vipsload operation in versions before and including 8.18.0 could incorrectly determine image dimensions leading to an integer overflow and a subsequent heap-based buffer overflow. This has been patched in version 8.18.1...
Security Bulletin: Code injection, cross-site scripting, and other vulnerabilities might affect IBM Storage Defender - Resiliency Service
Summary IBM Storage Defender - Resiliency Service is vulnerable to code injection, cross-site scripting, and others. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2025-46295 DESCRIPTION: Apache Commons Text versions prior to 1.10.0 included interpolation features that...
EUVD-2026-45967
Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the mailpit dump --http sub-command downloads every message from a remote Mailpit instance and writes each one as .eml inside the user-supplied output directory. The message ID field is taken verbatim from the JSON...
Linux Distros Unpatched Vulnerability : CVE-2026-44359
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's mainmatrix.yml workflow is triggered ...
CVE-2026-16224 jxxghp MoviePilot Application API improper authorization
A vulnerability was identified in jxxghp MoviePilot up to 2.13.5. The affected element is an unknown function of the file /jxxghp/MoviePilot of the component Application API. The manipulation leads to improper authorization. Remote exploitation of the attack is possible. The identifier of the pat...
CVE-2026-58209 affecting package telegraf for versions less than 1.31.0-24
CVE-2026-58209 affecting package telegraf for versions less than 1.31.0-24. A patched version of the package is available...
CVE-2026-58253 affecting package telegraf for versions less than 1.31.0-24
CVE-2026-58253 affecting package telegraf for versions less than 1.31.0-24. A patched version of the package is available...
CVE-2026-58252 affecting package telegraf for versions less than 1.31.0-24
CVE-2026-58252 affecting package telegraf for versions less than 1.31.0-24. A patched version of the package is available...
CVE-2026-58251 affecting package telegraf for versions less than 1.31.0-24
CVE-2026-58251 affecting package telegraf for versions less than 1.31.0-24. A patched version of the package is available...
CVE-2025-44904 affecting package hdf5 for versions less than 1.14.6-3
CVE-2025-44904 affecting package hdf5 for versions less than 1.14.6-3. A patched version of the package is available...
CVE-2026-58208 affecting package telegraf for versions less than 1.31.0-24
CVE-2026-58208 affecting package telegraf for versions less than 1.31.0-24. A patched version of the package is available...
CVE-2026-58250 affecting package telegraf for versions less than 1.31.0-24
CVE-2026-58250 affecting package telegraf for versions less than 1.31.0-24. A patched version of the package is available...
PT-2026-60992
A vulnerability was determined in zhayujie CowAgent up to 2.1.1. This affects the function WebFetch.execute of the file agent/tools/web fetch/web fetch.py. Executing a manipulation of the argument url can lead to server-side request forgery. The attack may be performed from remote. The exploit ha...
CVE-2026-54464
The CVE-2026-54464 issue affects the websocket-driver Ruby library. When used with the permessage-deflate extension, WebSocket servers/clients can accept messages larger than the configured maximum because length checks use the compressed data size (frame length headers) instead of the decompress...