Lucene search
+L

4396 matches found

OSV
OSV
added 2026/08/25 3:15 p.m.7 views

CVE-2023-54354 Nokogiri before 1.14.3 Null Pointer Dereference via libxml2

Nokogiri before 1.14.3 CRuby implementation only, when using the packaged libxml2 bundles libxml2 v2.10.3, which is vulnerable to NULL pointer dereferences in XML Schema processing xmlSchemaFixupComplexType, CVE-2023-28484, and xmlSchemaCheckCOSSTDerivedOK. An attacker who supplies a...

8.7CVSS5.6AI score
SaveExploits0References7
Debian CVE
Debian CVE
added 2026/08/25 3:15 p.m.19 views

CVE-2023-54354

Removed by vendor...

5.7AI score0.0035EPSS
SaveExploits0
Snyk
Snyk
added 2026/08/25 11:41 a.m.11 views

Server-side Request Forgery (SSRF)

Overview org.apache.hive:hive-common is a reading, writing, and managing large datasets residing in distributed storage using SQL. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via Avro SerDe schema resolution in AvroSerdeUtils.determineSchemaOrThrowExceptio...

8.5CVSS5.4AI score0.00587EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/25 11:41 a.m.12 views

Server-side Request Forgery (SSRF)

Overview org.apache.hive:hive-exec is a package for reading, writing, and managing large datasets residing in distributed storage using SQL. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via Avro SerDe schema resolution in...

8.5CVSS5.4AI score0.00587EPSS
SaveExploits0References2
NVD
NVD
added 2026/08/25 11:16 a.m.14 views

CVE-2026-55976

Server-Side Request Forgery SSRF in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authenticated remote attacker with CREATE TABLE privilege to cause the Hive server to fetch an attacker-controlled URL when resolving the avro.schema.url table property on an Avro table that is...

9.1CVSS0.00587EPSS
SaveExploits0References4
Vulnrichment
Vulnrichment
added 2026/08/25 10:13 a.m.7 views

CVE-2026-55976 Apache Hive: SSRF vulnerability in Hive Avro Serde due to Insufficient input validation on avro.schema.url

Server-Side Request Forgery SSRF in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authenticated remote attacker with CREATE TABLE privilege to cause the Hive server to fetch an attacker-controlled URL when resolving the avro.schema.url table property on an Avro table that is...

5.5AI score0.00587EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/08/25 10:13 a.m.13 views

EUVD-2026-65395

Server-Side Request Forgery SSRF in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authenticated remote attacker with CREATE TABLE privilege to cause the Hive server to fetch an attacker-controlled URL when resolving the avro.schema.url table property on an Avro table that is...

5.6AI score0.00587EPSS
SaveExploits0References4
CVE
CVE
added 2026/08/25 10:13 a.m.51 views

CVE-2026-55976

Apache Hive (versions before 4.2.1 ) is vulnerable to a Server-Side Request Forgery (SSRF) in the Avro SerDe schema resolution. The flaw stems from insufficient input validation on the avro.schema.url table property. An authenticated remote attacker with CREATE TABLE privileges can configure a ma...

5.7AI score0.00587EPSS
SaveExploits0References4Affected Software1
Positive Technologies
Positive Technologies
added 2026/08/25 12:00 a.m.57 views

PT-2026-81256

Server-Side Request Forgery SSRF in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authenticated remote attacker with CREATE TABLE privilege to cause the Hive server to fetch an attacker-controlled URL when resolving the avro.schema.url table property on an Avro table that is...

5.7AI score0.00587EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/08/25 12:00 a.m.15 views

PT-2026-81342

Nokogiri before 1.18.8 packages a vulnerable version of libxml2 before 2.13.8 that contains a heap-based buffer under-read CVE-2025-32415 in the xmlSchemaIDCFillNodeTables function in xmlschemas.c. The issue can be triggered when validating against an untrusted XML Schema, or when validating...

8.7CVSS5.6AI score0.0018EPSS
SaveExploits0References3
OSV
OSV
added 2026/08/24 1:43 p.m.7 views

JLSEC-2026-1374 Apache Avro Java SDK: Arbitrary Code Execution when reading Avro Data (Java SDK)

Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue...

9.2CVSS7.5AI score0.03256EPSS
SaveExploits0References13
AstraLinux
AstraLinux
added 2026/08/24 10:19 a.m.7 views

Astra Linux – Vulnerability in node-json-schema

JSON-schema is vulnerable to improperly controlled modification of object prototype attributes known as “Prototype Pollution”...

9.8CVSS6.8AI score0.0383EPSS
SaveExploits1References1
AstraLinux
AstraLinux
added 2026/08/24 10:19 a.m.9 views

Astra Linux – Vulnerability in PostgresSQL 11

A vulnerability was discovered in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim to use the...

8CVSS7.1AI score0.01908EPSS
SaveExploits0References2
AstraLinux
AstraLinux
added 2026/08/24 10:19 a.m.9 views

Astra Linux – Vulnerability in cloud-init

Sensitive data may have been exposed in cloud-init logs that are readable to the world before version 22.3, when schema failures were reported. This leakage could involve hashed passwords...

5.5CVSS6AI score0.00236EPSS
SaveExploits0References2
OSV
OSV
added 2026/08/21 11:26 a.m.12 views

BIT-DISCOURSE-2026-53960 Discourse: Hidden first-post excerpt is emitted in Q&A schema JSON-LD

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, hidden or otherwise unviewable first-post content was leaked as an excerpt in the publicly-served Q&A QAPage JSON-LD structured data, exposing it to any unauthenticated visitor and to search-engi...

5.3CVSS5.4AI score0.00195EPSS
SaveExploits0References2
NVD
NVD
added 2026/08/21 4:18 a.m.16 views

CVE-2026-65645

Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6. 8.3.8, 8.2.8, 8.1.8, and 7.10.15, the Meteor DDP methods getThreadsList and getThreadMessages accept rid / tmid as raw, untyped parameters with no schema validation. A MongoDB operator object e.g. "$gt": "4" can be substituted for ...

4.3CVSS0.00203EPSS
SaveExploits0References2
OSV
OSV
added 2026/08/21 2:53 a.m.23 views

CVE-2026-65645

Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6. 8.3.8, 8.2.8, 8.1.8, and 7.10.15, the Meteor DDP methods getThreadsList and getThreadMessages accept rid / tmid as raw, untyped parameters with no schema validation. A MongoDB operator object e.g. "$gt": "4" can be substituted for ...

4.3CVSS5.6AI score
SaveExploits0References4
Github Security Blog
Github Security Blog
added 2026/08/20 6:30 p.m.16 views

NocoBase backup restore schema name allows command injection

Summary NocoBase @nocobase/plugin-backups 2.0.57 restores PostgreSQL backups by interpolating the backup metadata schema name into shell command strings that are executed with Node.js childprocess.exec. A backup-management user who can restore an uploaded PostgreSQL backup with forced schema...

6.7CVSS6.4AI score0.00721EPSS
SaveExploits0References5Affected Software1
OSV
OSV
added 2026/08/20 6:07 p.m.18 views

RLSA-2026:56007 Important: mysql8.4 security, bug fix, and enhancement update

MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon mysqld and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files. Security Fixes: mysql:...

8.4CVSS7.7AI score0.00466EPSS
SaveExploits0References31
Rockylinux
Rockylinux
added 2026/08/20 6:07 p.m.17 views

mysql8.4 security, bug fix, and enhancement update

An update is available for mysql8.4. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list MySQL is a multi-user, multi-threaded SQL database server. MySQL is a...

8.4CVSS7.7AI score0.00466EPSS
SaveExploits0
Rows per page
Query Builder