175877 matches found
RUSTSEC-2026-0306 `hex_decode_unchecked` AVX2 path reads past `src`
fasterhex::hexdecodeunchecked is a safe function. On x86 and x8664, when AVX2 is enabled, hexdecodeavx2 keeps decoding while dst.len = 32 and then loads 32 bytes from src and 32 bytes from src32... Nothing in that loop requires src to contain 64 bytes. A safe caller can pass a short src and a dst...
`hex_decode_unchecked` AVX2 path reads past `src`
fasterhex::hexdecodeunchecked is a safe function. On x86 and x8664, when AVX2 is enabled, hexdecodeavx2 keeps decoding while dst.len = 32 and then loads 32 bytes from src and 32 bytes from src32... Nothing in that loop requires src to contain 64 bytes. A safe caller can pass a short src and a dst...
net-snmp:snmp_sec_models_fuzzer: Heap-buffer-overflow in vacm_getAccessEntry
Project: git://git.code.sf.net/p/net-snmp/code https://github.com/net-snmp/net-snmp.git Detailed Report: https://oss-fuzz.com/testcase?key=4899370886299648 Project: net-snmp Fuzzing Engine: libFuzzer Fuzz Target: snmpsecmodelsfuzzer Job Type: libfuzzerasannet-snmp Platform Id: linux Crash Type:...
OPENSUSE-SU-2026:21884-1 Security update for amazon-ssm-agent
This update for amazon-ssm-agent fixes the following issues: - CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library bsc1278681. - CVE-2026-71556: github.com/go-git/go-git/v5: arbitrary file read/write via symbolic lin...
OPENSUSE-SU-2026:21883-1 Security update for freeipmi
This update for freeipmi fixes the following issues: - CVE-2026-85504: stack-based buffer overflow via malformed Fujitsu SEL long-text responses bsc1278719. - CVE-2026-85505: Denial of Service via stack-based buffer over-read in ipmi-oem bsc1278722. - CVE-2026-85506: Arbitrary code execution via...
EUVD-2026-83616
QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...
SUSE CVE-2026-57228
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.13 until 7.0.17, the SMTP MIME quoted-printable decoder in src/util-decode-mime.c can read one byte past a heap buffer when a quoted-printable escape sequence is split...
CVE-2026-81652: Authorization Bypass Through User-Controlled Key
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given image record before returning it, allowing users with the Contributor role and above to read the stored metadata of any image on the site, including images in...
PT-2026-103512
faster hex::hex decode unchecked is a safe function. On x86 and x86 64, when AVX2 is enabled, hex decode avx2 keeps decoding while dst.len = 32 and then loads 32 bytes from src and 32 bytes from src32... Nothing in that loop requires src to contain 64 bytes. A safe caller can pass a short src and...
PT-2026-96011
Name of the Vulnerable Software and Affected Versions dmlc dgl versions prior to 2.1.0 Description A remote attack is possible through the manipulation of the path argument in the load info/ read torch data function within the utils.py file, leading to deserialization. Deserialization occurs when...
Linux Distros Unpatched Vulnerability : CVE-2026-94056
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory...
CVE-2026-94056
Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory...
DEBIAN-CVE-2026-94056
Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory...
CVE-2026-93988
QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...
CVE-2026-93988
QloApps versions through 1.7.0 contain a path traversal vulnerability in the getEmailHTML action of admin/ajax.php. An authenticated back-office user can supply relative path sequences in the email parameter to bypass directory restrictions and read arbitrary files , including database credential...
CVE-2026-93988 QloApps through 1.7.0 Arbitrary File Read via getEmailHTML
QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...
CVE-2026-93988 QloApps through 1.7.0 Arbitrary File Read via getEmailHTML
QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...
CVE-2026-93988 QloApps through 1.7.0 Arbitrary File Read via getEmailHTML
QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...
