92227 matches found
Infinite loop
Overview org.webjars.npm:tar is a full-featured Tar for Node.js. Affected versions of this package are vulnerable to Infinite loop via the replace method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size...
Exploit for Unprotected Alternate Channel in Rockwellautomation Allen-Bradley_Stratix_5200_Firmware
Cisco IOS XE CVE-2023-20198 Scanner A Python wrapper script f...
CVE-2026-59874 node-tar: Negative tar entry size causes infinite loop in archive replace
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18...
[SECURITY] Fedora 43 Update: betterleaks-1.6.0-1.fc43
A Better Secrets Scanner built for configurability and speed...
[SECURITY] Fedora 44 Update: betterleaks-1.6.0-1.fc44
A Better Secrets Scanner built for configurability and speed...
CVE-2026-42505: Insertion of Sensitive Information Into Sent Data
Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello...
CVE-2026-15171: NULL Pointer Dereference
SSH protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service...
CVE-2026-5923: Cross-Site Request Forgery (CSRF)
Malicious use of a stolen cookie might allow modifications to the contents of the IP phone’s webpage...
CVE-2026-51535: Uncontrolled Resource Consumption
In OpENer 2.3.0 commit 76b95cf, a resource exhaustion Denial of Service vulnerability exists in its network processing loop...
CVE-2026-15165: Heap-based Buffer Overflow
TLS ECH decryptor crash in Wireshark 4.6.0 to 4.6.6 allows denial of service...
CVE-2026-15164: Heap-based Buffer Overflow
Crash in ciscodump 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service...
CVE-2026-8800: Incorrect Authorization
Incorrect Authorization vulnerability in Progress MOVEit Transfer Audit User module. This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3...
CVE-2026-8650: Relative Path Traversal
Relative path traversal vulnerability in Progress MOVEit Transfer Admin Settings module. This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3...
CVE-2026-8649: Improper Neutralization of Special Elements in Data Query Logic
Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer Custom Reports modules. This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3...
CVE-2026-36028: Authentication Bypass Using an Alternate Path or Channel
A protection mechanism failure in the Code 27 Companion Hub allows an attacker with physical access to completely bypass kiosk restrictions via a factory reset...
CVE-2026-59261: Incomplete List of Disallowed Inputs
OpenClaw before 2026.5.28 contains a credential exposure vulnerability where workspace dotenv files can override provider credentials. Attackers with lower-trust access to configured input paths can expose sensitive data and credentials that should remain within trusted boundaries...
CVE-2026-39822: UNIX Symbolic Link (Symlink) Following
On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symbolic link pointing...
CVE-2025-3110: Inconsistent Interpretation of HTTP Requests
OpenVPN Access Server 2.7.2 through 3.1.0 accepts bare line-feed sequences inside HTTP header values, allowing remote attackers to perform HTTP request smuggling when deployed behind a reverse proxy...
CVE-2026-9074: Improper Neutralization of Special Elements used in an SQL Command
IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injection vulnerability in the password reset functionality...