91482 matches found
CVE-2026-27999: Missing Authorization
Subscriber Broken Access Control in Tourfic = 2.23.1 versions...
CVE-2026-18086: Out-of-bounds Write
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary code or cause a denial of service due to improper bounds checking...
CVE-2026-16878: Out-of-bounds Read
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read...
CVE-2026-28175: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Visitors Traffic Real Time Statistics = 8.11 versions...
Linux Distros Unpatched Vulnerability : CVE-2026-73071
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, jsondecodeitem in src/json.c can retain a stale pointer after jsondecodestring...
CVE-2026-28161: Incorrect Privilege Assignment
Subscriber Privilege Escalation in Service Finder Booking = 6.2 versions...
CVE-2026-66691: Weak Password Recovery Mechanism for Forgotten Password
Unauthenticated Broken Access Control in Nokri = 1.6.6 versions...
CVE-2026-56654: Improper Access Control
Privilege Escalation via Access Token Scope Escalation in API...
CVE-2026-58436: Inefficient Algorithmic Complexity
ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests...
CVE-2026-56859: Allocation of Resources Without Limits or Throttling
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...
CVE-2026-33818: Uncontrolled Resource Consumption
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...
CVE-2026-56853: Allocation of Resources Without Limits or Throttling
When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this...
CVE-2026-56858: Improper Neutralization of Input During Web Page Generation
Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...
CVE-2026-56859: Allocation of Resources Without Limits or Throttling
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...
CVE-2026-56860: Inefficient Algorithmic Complexity
Previously, resolving relative paths containing parent directory '..' segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking f...
CVE-2026-56862: Allocation of Resources Without Limits or Throttling
Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely...
CVE-2026-17476: Out-of-bounds Write
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an improper buffer write...
CVE-2026-28187: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Knowledge Base for Documentation, FAQs with AI Assistance = 17.211.0 versions...
CVE-2026-56862: Allocation of Resources Without Limits or Throttling
Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely...