977175 matches found
EUVD-2026-56295
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...
CVE-2026-63514 Microsoft SharePoint Server Remote Code Execution Vulnerability
...
CVE-2026-63514 Microsoft SharePoint Server Remote Code Execution Vulnerability
...
CVE-2026-63514
Summary: CVE-2026-63514 involves deserialization of untrusted data in Microsoft Office SharePoint, enabling an authorized attacker to execute code remotely over a network. Affected component: SharePoint Server (deserialization path in untrusted data handling). Impact: Remote code execution with H...
EUVD-2026-56290
Improper limitation of a pathname to a restricted directory 'path traversal' in Microsoft Teams for Android allows an unauthorized attacker to execute code over a network...
CVE-2026-65768
Improper limitation of a pathname to a restricted directory 'path traversal' in Microsoft Teams for Android allows an unauthorized attacker to execute code over a network...
CVE-2026-65768 Microsoft Teams Remote Code Execution Vulnerability
...
CVE-2026-65768 Microsoft Teams Remote Code Execution Vulnerability
...
2026-08 .NET 10.0.11 Security Update for x64 Client (KB5122106)
2026-08 .NET 10.0.11 Security Update for x64 Client KB5122106...
2026-08 Security and Quality Rollup for .NET Framework 3.5, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows Server 2012 R2 for x64 (KB5121649)
A security issue has been identified in a Microsoft software product that could affect your system. You can help protect your system by installing this update from Microsoft. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article...
Security Bulletin: IBM WebSphere Application Server Liberty is affected by a remote code execution and path-segment injection vulnerability (CVE-2026-14976, CVE-2026-15280)
Summary IBM WebSphere Application Server Liberty is affected by a remote code execution and path-segment injection vulnerability with the collectiveController-1.0 enabled. Vulnerability Details CVEID:CVE-2026-15280 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ...
Malicious code in bs58-12 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d59b2d561269e6779eed82e12abe726403e9a2419936c01a4deaea9c3e70b2c Package bs58-12 presents itself as the popular bs58 base58 library README copied from bs58, advertising npm i --save bs58 but its own code is a thin...
MAL-2026-13758 Malicious code in bs58-11 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af29bcf6fea2d386f8beb757fa38bac5f1cc6dbae984795f5fd1f4356afd83f7 Package bs58-11 is published under a name that resembles the popular bs58 module. Its README self-identifies as bs58 and instructs npm i --save bs58,...
Malicious code in base65-12x (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79b553d84d7f4dc5347840ddb97f16738eed2e52ac9757b48d2cb31ba1af7122 The package name base65-12x typosquats the popular base-x base-encoding library and reuses base-x's repository as its homepage. Both the CJS entry...
openjdk-orb: unauthed class loading via IIOP in EAP
when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...
netty: io.netty/netty-codec-http: Netty: Request smuggling via malformed Transfer-Encoding parsing
A flaw was found in Netty. This vulnerability allows a remote attacker to perform request smuggling attacks due to incorrect parsing of malformed Transfer-Encoding headers. By exploiting this flaw, an attacker can bypass security controls and potentially access sensitive information or manipulate...
bouncycastle: BC-JAVA: private key leakage via non-constant time comparisons
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA core. A covert timing channel vulnerability, caused by non-constant time comparisons, risks the leakage of private keys in the FrodoKEM implementation. An unauthenticated, remote attacker can potentially exploit this timing discrepancy ...
netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payloads
A flaw was found in netty-codec-redis. A remote attacker can exploit this vulnerability by sending specially crafted Redis payloads across multiple connections without proper termination. This can exhaust the server's direct memory pool, leading to a Denial of Service DoS condition where legitima...
netty-codec-redis: Netty: Denial of Service via malicious Redis array header
A flaw was found in Netty, a network application framework. The RedisArrayAggregator component pre-allocates memory based on the declared element count in a Redis array header. A remote attacker can exploit this by sending a small, malicious Redis array header that claims a huge initial capacity,...
netty: Netty: High integrity impact due to improper DNS domain name constraint enforcement
A flaw was found in Netty. Netty's DNS Domain Name System codec does not properly enforce domain name constraints as defined in RFC 1035 during both encoding and decoding processes. This vulnerability allows a remote attacker to exploit the decoder using malicious DNS responses or exploit the...