300339 matches found
SUSE CVE-2026-16318
The QUIC transport parameters extension handler in s2n-tls incorrectly uses s2nalloc instead of s2nrealloc to store the peer's transport parameters. When a TLS 1.3 connection goes through a HelloRetryRequest, the handler is called twice on the same connection. On the second call, s2nalloc zeroes...
SUSE CVE-2026-16560
A heap-buffer-overflow flaw was found in Directory Server 389-ds-base. When a DN contains a legacy-quoted value, the server won't close the heap allocation allowing another call to refer to the same memory pointer causing a denial of service or an arbitrary memory write operation...
CVE-2026-54133 vulnerabilities
Vulnerabilities for packages: nextcloud-server...
CVE-2026-54133 vulnerabilities
Vulnerabilities for packages: nextcloud-server...
CVE-2026-56167
Server-side request forgery ssrf in Azure AI Search allows an authorized attacker to elevate privileges over a network...
[SECURITY] Fedora 44 Update: python-lsp-black-2.0.0-17.fc44
lsp-black is a python-lsp-server plugin that adds support to black autoformatter. This is forked from pyls-black to be compatible wth community maintained language-server python-lsp-server...
EUVD-2026-48435
9Router before 0.4.72 contains a server-side request forgery SSRF vulnerability in the /v1/web/fetch endpoint. The endpoint accepts a user-controlled url parameter and passes it to a configured external scraping provider Firecrawl, Jina Reader, Tavily, or Exa to fetch content. The URL is only...
EUVD-2025-210506
Cal.com calcom/cal.diy before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Components RSC request handling deserializes attacker-controlled input. A remote attacker can send a crafted RSC request to the server and cause...
PT-2026-64381
Name of the Vulnerable Software and Affected Versions libssh2 versions prior to 1.11.1 Description A missing bounds check in the publickey subsystem allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and the free of an uninitialized pointer. In the libssh2...
The vulnerability of the Oracle WebLogic Server application server’s kernel allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerability of the Oracle WebLogic Server application server’s kernel is related to deficiencies in the authentication process. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of the protected information using the SAML protoc...
PT-2026-64420
Name of the Vulnerable Software and Affected Versions Tycon Systems TPDIN-Monitor-WEB2 affected versions not specified Description The web management interface fails to perform server-side validation of credentials during the login process. An unauthenticated remote attacker can bypass the...
ROS-20260724-73-0018
The vulnerability of the Oracle MySQL Server component of the database management system’s optimizer is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service interruptions...
PT-2026-64314
Server-side request forgery ssrf in Data Quality allows an unauthorized attacker to elevate privileges over a network...
PT-2026-64318
Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that allows network-adjacent attackers to bypass trusted host restrictions by exploiting the server's replacement of user-configured trusted hosts with a wildcard that reflects...
ROS-20260724-73-0016
The vulnerability of the Oracle MySQL Server component of the database management system’s optimizer is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service interruptions...
ROS-20260724-73-0017
The vulnerability of the Oracle MySQL Server component of the database management system’s optimizer is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service interruptions...
PT-2026-64378
Name of the Vulnerable Software and Affected Versions sysPass versions prior to 3.2.12 Description Authenticated administrators can execute arbitrary commands as the web server process user by configuring a malicious backup path and triggering a backup. The FileBackupService constructs a tar shel...
Apache Syncope Server Request Forgery Vulnerability (CNVD-2026-30661)
Apache Syncope is an open-source identity management system, primarily used for managing the identity lifecycle and access control of enterprise users. There are security vulnerabilities in Apache Syncope. These vulnerabilities stem from the failure to properly validate user inputs during...
PT-2026-64434
Name of the Vulnerable Software and Affected Versions Cloudreve versions prior to 4.17.0 Description An authenticated recipient of a single-file share can access file-activity metadata for other files and folders located in the owner's parent folder that were not intended to be shared. This occur...
PT-2026-64286
Name of the Vulnerable Software and Affected Versions Parse Server versions 9.0.0 through 9.10.0-alpha.4 Parse Server versions 8.2.2 through 8.6.85 Description GraphQL validation error messages reveal the names of required custom input fields even when public introspection is disabled via the...