91463 matches found
CVE-2026-56860: Inefficient Algorithmic Complexity
Previously, resolving relative paths containing parent directory '..' segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking f...
CVE-2026-56862: Allocation of Resources Without Limits or Throttling
Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely...
CVE-2026-58438: Missing Authorization
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access...
CVE-2026-17206: Out-of-bounds Write
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to a buffer overflow...
CVE-2026-16929: Out-of-bounds Write
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a buffer overflow...
CVE-2026-16674: Untrusted Search Path
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an untrusted search path...
CVE-2026-28159: Missing Authorization
Subscriber Broken Access Control in Service Finder Booking = 6.2 versions...
CVE-2026-28002: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22...
CVE-2026-27539: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Welcart e-Commerce = 2.11.31 versions...
CVE-2026-27535: Missing Authorization
Subscriber Broken Access Control in Solace Extra = 1.6.0 versions...
CVE-2026-28008: Authentication Bypass by Spoofing
Unauthenticated Broken Authentication in OAuth Single Sign On – SSO OAuth Client = 7.0.0 versions...
CVE-2026-18020: Out-of-bounds Read
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an off-by-one error in bounds checking...
CVE-2026-17476: Out-of-bounds Write
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an improper buffer write...
CVE-2026-73479: Improper Encoding or Escaping of Output
dua-cli fails to filter terminal escape sequences when printing marked file paths after exiting the TUI interface. Attackers can craft file names containing OSC/CSI escape sequences that are interpreted by the terminal emulator when printed, enabling title spoofing, clipboard manipulation, or oth...
CVE-2026-66467: Improper Neutralization of Input During Web Page Generation
Subscriber Cross Site Scripting XSS in FluentCommunity = 2.7.5 versions...
CVE-2026-66465: Authentication Bypass Using an Alternate Path or Channel
Unauthenticated Broken Authentication in Cartify = 1.3.0.1 versions...
CVE-2026-66462: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Unauthenticated Sensitive Data Exposure in WooCommerce Appointments = 5.3.8 versions...
CVE-2026-66461: Missing Authorization
Unauthenticated Broken Access Control in SMEPay: UPI Gateway for WooCommerce = 1.0.5 versions...