569 matches found
EUVD-2026-125053
GPAC through 26.07.0 contains a NULL pointer dereference vulnerability in the MPEG-4 Form spatial-constraint handlers in src/compositor/mpeg4form.c that lets attackers crash the process via unchecked group lookups. Attackers can supply a crafted XMT scene whose Form constraints reference a...
CVE-2026-114582
A flaw was found in Django. When handling spatial reference strings, input is passed directly to the underlying Geospatial Data Abstraction Library GDAL, which by default resolves network addresses and accesses files on the host system. A remote attacker can exploit this flaw by providing a craft...
django: Django: Remote code execution via GeoDjango spatial lookups
A flaw was found in Django. GeoDjango's spatial lookups can be exploited by a staff user with view permissions who submits a specially crafted spatial-field filter. This vulnerability allows an attacker to write arbitrary files to the server, which can lead to remote code execution. Additionally,...
django: Django: Remote code execution via GeoDjango spatial lookups
A flaw was found in Django. GeoDjango's spatial lookups can be exploited by a staff user with view permissions who submits a specially crafted spatial-field filter. This vulnerability allows an attacker to write arbitrary files to the server, which can lead to remote code execution. Additionally,...
django: Django: Remote code execution via GeoDjango spatial lookups
A flaw was found in Django. GeoDjango's spatial lookups can be exploited by a staff user with view permissions who submits a specially crafted spatial-field filter. This vulnerability allows an attacker to write arbitrary files to the server, which can lead to remote code execution. Additionally,...
Server-side Request Forgery (SSRF)
Overview Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in GeoDjango's GeoJSON handling, reached through spatial-field lookups, the GeometryField form...
GeoDjango Spatial Field DoS
The vulnerability related to spatial field and component search in GeoDjango, a software platform for Django web applications, involves uncontrolled recursion. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service...
GeoDjango Spatial Search Code Execution
The spatial search vulnerability in the GeoDjango software platform for Django web applications is related to improper external handling of filenames or file paths. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary code...
Security update for python-Django (critical)
openSUSE security update: security update for python-django ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22196-1 Rating: critical References: bsc1284471 bsc1284472 bsc1284476 bsc1284481 Cross-References: CVE-2026-77050 CVE-2026-84429 CVE-2026-878...
django: Django: Remote code execution via GeoDjango spatial lookups
A flaw was found in Django. GeoDjango's spatial lookups can be exploited by a staff user with view permissions who submits a specially crafted spatial-field filter. This vulnerability allows an attacker to write arbitrary files to the server, which can lead to remote code execution. Additionally,...
On the Performance of AoA-Based Physical-Layer Authentication under Multi-Source Impersonation Attacks
This paper investigates cooperative impersonation attacks against angle-of-arrival AoA-based authentication for a wireless communication receiver equipped with a digital uniform linear array. Specifically, we characterize the vulnerability and robustness of this authentication system in relation ...
OPENSUSE-SU-2026:22196-1 Security update for python-Django
This update for python-Django fixes the following issues: Changes in python-Django: - CVE-2026-87975: an authenticated user permitted to submit a formset to delete rows outside the limiting queryset, without any permission on the targeted object, marking an out-of-queryset object for deletion...
CVE-2026-55465
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 22.04 to before version 26.05, the unauthenticated REST endpoint GET /api/v1/index/solrField/spatial/search concatenates the user-supplied region query parameter directly into a Sol...
CVE-2026-55465 Goobi viewer: Solr injection via unvalidated region parameter in spatial search
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 22.04 to before version 26.05, the unauthenticated REST endpoint GET /api/v1/index/solrField/spatial/search concatenates the user-supplied region query parameter directly into a Sol...
CVE-2026-55465 Goobi viewer: Solr injection via unvalidated region parameter in spatial search
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 22.04 to before version 26.05, the unauthenticated REST endpoint GET /api/v1/index/solrField/spatial/search concatenates the user-supplied region query parameter directly into a Sol...
CVE-2026-55465
The Goobi viewer web application (versions 22.04 to before 26.05 ) is vulnerable to Solr injection via an unauthenticated REST endpoint: GET /api/v1/index/{solrField}/spatial/search. The root cause is the direct concatenation of the user-supplied region query parameter into a Solr query string wi...
CVE-2026-55465 Goobi viewer: Solr injection via unvalidated region parameter in spatial search
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 22.04 to before version 26.05, the unauthenticated REST endpoint GET /api/v1/index/solrField/spatial/search concatenates the user-supplied region query parameter directly into a Sol...
EUVD-2026-109066
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 22.04 to before version 26.05, the unauthenticated REST endpoint GET /api/v1/index/solrField/spatial/search concatenates the user-supplied region query parameter directly into a Sol...
Intranda goobi-viewer-core SQL injection vulnerability
A security vulnerability exists in Intranda Goobi Viewer Core versions from 22.04 up to and including 26.05. This vulnerability arises because the unauthenticated REST endpoint GET /api/v1/index/solrField/spatial/search directly concatenates user-supplied region query parameters into the Solr que...
PT-2026-122134
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 22.04 to before version 26.05, the unauthenticated REST endpoint GET /api/v1/index/solrField/spatial/search concatenates the user-supplied region query parameter directly into a Sol...