CVE-2026-6494

CVE-2026-6494 describes a log-injection vulnerability in the AAP MCP server. An unauthenticated remote attacker can send specially crafted input to the toolsetroute parameter, which is written to logs without proper sanitization. This allows insertion of control characters (e.g., newlines and ANS...

CVE-2026-6494

A flaw was found in the AAP MCP server. An unauthenticated remote attacker can exploit a log injection vulnerability by sending specially crafted input to the toolsetroute parameter. This parameter is not properly sanitized before being written to logs, allowing the attacker to inject control...

The vulnerability of the Google Chrome browser’s Video component, which allows a hacker to execute arbitrary code.

The vulnerability of the Google Chrome browser’s Video component is related to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

The vulnerability of the Dawn component in the Google Chrome browser, which allows a hacker to bypass the sandboxing protection mechanism

The vulnerability of the Dawn component in the Google Chrome browser is related to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to bypass the sandboxing protection mechanisms...

The vulnerability of the ANGLE library in Google Chrome browser allows a hacker to bypass the sandboxing protection mechanism.

The vulnerability of the ANGLE library in Google Chrome browsers is related to buffer overflow in dynamic memory. Exploiting this vulnerability could allow a remote attacker to bypass the sandboxing protection mechanisms...

ROS-20260417-73-0031

Vulnerability in glpi related to a flaw in the authentication procedure. Exploitation of the vulnerability could allow an attacker acting remotely to escalate his privileges...

PT-2026-33444

Name of the Vulnerable Software and Affected Versions Dell PowerProtect Data Domain with Data Domain Operating System DD OS versions 7.7.1.0 through 8.5 Dell PowerProtect Data Domain with Data Domain Operating System DD OS versions 8.3.1.0 through 8.3.1.20 Dell PowerProtect Data Domain with Data...

MiniUPnP 安全漏洞

MiniUPnP is a set of UPnP tools developed by the Miniupnp project, which can be used in embedded systems. These tools enable devices in home and corporate networks to connect with each other. MiniUPnP has a security vulnerability, stemming from integer underflow in the parsing of SOAPAction...

PT-2026-33443

Name of the Vulnerable Software and Affected Versions Dell PowerProtect Data Domain with Data Domain Operating System DD OS versions 8.4 through 8.5 Description An improper restriction of excessive authentication attempts allows a high privileged attacker with remote access to potentially gain...

The vulnerability of Google Chrome’s Graphite component, which allows a hacker to bypass the sandboxing protection mechanism

The vulnerability of Google Chrome’s Graphite component is related to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to bypass the sandboxing protection mechanisms...

ROS-20260417-73-0025

Vulnerability in python-PyPDF2 related to uncontrolled resource consumption. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...

ROS-20260417-73-0026

A vulnerability in the crparserparseanycore function of the cr-parser.c component of the css2 Libcroco cascading tables library is related to uncontrolled recursion. Exploitation of the vulnerability could allow an attacker acting remotely to compromise data integrity as well as cause a denial of...

The vulnerability of Google Chrome’s CORS mechanism allows a hacker to gain unauthorized access to protected information.

The vulnerability of Google Chrome’s CORS mechanism is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the Proxy component in Google Chrome, which allows a hacker to bypass the sandboxing protection mechanism

The vulnerability of the Google Chrome browser’s Proxy component is related to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to bypass the sandboxing protection mechanisms...

The vulnerability of the Google Chrome browser’s Media component, which allows a hacker to execute arbitrary code.

The vulnerability of the Google Chrome browser’s Media component is related to reading beyond the buffer in memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

PT-2026-33431

A flaw was found in the AAP MCP server. An unauthenticated remote attacker can exploit a log injection vulnerability by sending specially crafted input to the toolsetroute parameter. This parameter is not properly sanitized before being written to logs, allowing the attacker to inject control...

BIT-DOTNET-SDK-2026-25667

ASP.NET Core Kestrel in Microsoft .NET 8.0 before 8.0.22 and .NET 9.0 before 9.0.11 allows a remote attacker to cause excessive CPU consumption by sending a crafted QUIC packet, because of an incorrect exit condition for HTTP/3 Encoder/Decoder stream processing...

CVE-2026-35469

spdystream is a Go library for SPDY multiplexing. In versions ≤ 0.5.0, the SPDY/3 frame parser allocates memory for SETTINGS counts, header counts, and header field sizes without proper bounds checking, enabling large on-the-wire values to exhaust memory via crafted control frames. A remote peer ...

perl-xml-parser: XML::Parser: Memory corruption via deeply nested XML files

A flaw was found in XML::Parser, a Perl module for parsing XML. This vulnerability, an off-by-one heap buffer overflow, occurs when processing an XML file with very deep element nesting. A remote attacker could exploit this by providing a specially crafted XML file, potentially leading to memory...

CVE-2026-20184

A vulnerability in the integration of single sign-on SSO with Control Hub in Cisco Webex Services could have allowed an unauthenticated, remote attacker to impersonate any user within the service. This vulnerability existed because of improper certificate validation. Prior to this vulnerability...