CVE-2026-42127: Uncontrolled Resource Consumption

The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access tok...

CVE-2026-42127: Uncontrolled Resource Consumption

The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access tok...

CVE-2026-12549: Buffer Access with Incorrect Length Value

The fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow checks with a general signed comparison. When a client sends a Range request with a suffix length exceeding the content size, the resulting negative start value is not properly clamped, leading t...

CVE-2025-71344: Deserialization of Untrusted Data

picklescan before 0.0.30 affected versions 0.0.26 and earlier fails to detect the ensurepip.runpip built-in function when scanning pickle files, allowing attackers to execute arbitrary code. Malicious pickle files embedding ensurepip.runpip calls in reduce methods bypass picklescan detection and...

CVE-2025-71348 picklescan - Arbitrary Code Execution via torch.utils._config_module.load_config Bypass

picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils.configmodule.loadconfig function within reduce methods. Attackers can craft pickle files embedding arbitrary code that evades detection but executes during pickle.load, enabling remote code execution in supply...

CVE-2026-56410: Integer Overflow or Wraparound

xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId...

CVE-2026-56408: Integer Overflow or Wraparound

libexpat before 2.8.2 has an integer overflow in copyString...

CVE-2026-56409: Integer Overflow or Wraparound

xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used...

CVE-2026-56406: Integer Overflow or Wraparound

libexpat before 2.8.2 has an integer overflow in XMLParseBuffer because it lacked a check that was present in XMLParse...

CVE-2026-56405: Integer Overflow or Wraparound

libexpat before 2.8.2 has an integer overflow in getAttributeId...

CVE-2026-56404: Integer Overflow or Wraparound

libexpat before 2.8.2 has an integer overflow in addBinding...

sql-injection-vulnerability-scanner

...

CVE-2026-9265: Out-of-bounds Read

Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits a heap OOB read in printattribute UTF8STRING path. printattribute copies a UTF8STRING ASN.1 attribute value into a heap buffer sized exactly to its declared length via strncpy, leaving no NUL terminator. Downstream callers run strlen on...

CVE-2026-56355: Incorrect Behavior Order

GNU Savannah Administration Savane through 3.17 uses untrusted data as part of authorization...

@openinc/parse-server-opendash (>=4.0.0, <=4.0.29) potentially affected by CVE-2026-53726 via parse-server (>=9.6.0-alpha.37, <=9.8.0)

parse-server NPM version =9.6.0-alpha.37, =4.0.0, =4.0.29 Source cves: CVE-2026-53726 Source advisory: OSV:GHSA-WMWX-JR2P-4J4R...

GHSA-8PXW-9C75-6W56 vulnerabilities

Vulnerabilities for packages: neuvector-scanner-fips, neuvector-scanner...

CVE-2025-8077 vulnerabilities

Vulnerabilities for packages: neuvector-scanner-fips, neuvector-scanner...

GHSA-8PXW-9C75-6W56 vulnerabilities

Vulnerabilities for packages: neuvector-scanner...

CVE-2025-8077 vulnerabilities

Vulnerabilities for packages: neuvector-scanner...

CVE-2026-51845: Undefined Security Weakness

Tenda AC7 v15.03.06.44 contains a stack buffer overflow vulnerability in the /goform/AdvSetMacMtuWan interface via the mac parameter...