IFA

IFA Disk-Flooding-Angriff via IndexedDB IFA ist ein Proof of Concept PoC, der zeigt, wie ein Angreifer die IndexedDB-API in gängigen Webbrowsern ausnutzen kann, um einen Disk-Flooding-Angriff durchzuführen. Dieser Angriff nutzt insbesondere das Fehlen von Einschränkungen in IndexedDB aus, sodass...

Langflow < 1.9.1 - Unauthenticated File Upload

Langflow 1.9.1 contains an unrestricted file upload caused by lack of upload limitations, letting unauthenticated attackers exhaust server space and leak absolute file paths, exploit requires network access. id: CVE-2026-55450 info: name: Langflow 1.9.1 - Unauthenticated File Upload author: xtr0n...

CVE-2020-14065

Icewarp Email Server 12.3.0.1 uploaddearquivoilimitado https://nvd.nist.gov/vuln/detail/CVE-2020-14065...

EUVD-2026-64745

DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits on file size, file count, or total storage consumed in /blackbox/upgrade/, as well as overwrite existing files in that directory. An...

CVE-2026-78251 DJI Drone FTP Service Allows Unrestricted Storage Consumption of the /blackbox Directory

DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits on file size, file count, or total storage consumed in /blackbox/upgrade/, as well as overwrite existing files in that directory. An...

CVE-2026-78251 DJI Drone FTP Service Allows Unrestricted Storage Consumption of the /blackbox Directory

DJI drones (15 models including Mavic 4 Pro, Air 3S, Mini 5 Pro, and others) expose an FTP service with hardcoded credentials shared across affected firmware versions. An attacker with access to the drone's internal network or USB RNDIS interface can upload unlimited files to /blackbox/upgrade/, ...

PT-2026-79833

Name of the Vulnerable Software and Affected Versions DJI Neo versions prior to 01.00.0400 DJI Neo 2 versions prior to 01.00.0500 DJI Flip versions prior to 01.00.1200 DJI Air 3 versions prior to 01.00.1600 DJI Air 3S versions prior to 01.00.1400 DJI Avata 2 versions prior to 01.00.0400 DJI Avata...

PT-2026-69151

Name of the Vulnerable Software and Affected Versions JupyterHub versions prior to 5.5.0 Description Invalid input provided to form-based login authenticators allows an unauthenticated attacker to insert an unbounded, attacker-controlled username into failed-login logs. This can lead to the...

PYSEC-2026-2520 OpenStack Horizon has Incorrect Behavior Order

An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3. There is a write operation to the session storage backend before authentication and thus storage can be exhausted by unauthenticated requests. This is a regression of the CVE-2014-8124 fix...

UBUNTU-CVE-2026-20216

A vulnerability in the InstallShield file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper handling of temporary resources during file scanning. An attacker could exploit this vulnerabilit...

PYSEC-0000-CVE-2026-55450

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, unauthenticated users can upload any amount of data to the server without any limitations. No need for any prior knowledge, only network access to Langflow. This can lead to space exhaustion on the...

CVE-2026-48500

Filament is a collection of full-stack components for accelerated Laravel development. From 3.0.0 until 3.3.52, 4.11.5, and 5.6.5, any schema can contain a file upload form field, so Filament applies Livewire's WithFileUploads trait to the Livewire component the schema is embedded in. However, so...

libp2p 输入验证错误漏洞

libp2p is a modular peer-to-peer network framework developed under the open-source license. Prior to version 16.2.6, libp2p had a vulnerability related to input validation errors. This vulnerability stemmed from unverified remote peers being able to send unlimited PUTVALUE messages, which could...

CVE-2026-43002

An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3. There is a write operation to the session storage backend before authentication and thus storage can be exhausted by unauthenticated requests. This is a regression of the CVE-2014-8124 fix...

OpenStack Horizon has Incorrect Behavior Order

An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3. There is a write operation to the session storage backend before authentication and thus storage can be exhausted by unauthenticated requests. This is a regression of the CVE-2014-8124 fix...

EUVD-2026-27406

An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3. There is a write operation to the session storage backend before authentication and thus storage can be exhausted by unauthenticated requests. This is a regression of the CVE-2014-8124 fix...

CVE-2026-43002

CVE-2026-43002 (OpenStack Horizon) affects Horizon 25.6 and 25.7 prior to 25.7.3. A write operation to the session storage backend occurs before authentication, allowing unauthenticated requests to exhaust storage. This is a regression of CVE-2014-8124. Impact: potential denial of service due to ...

Linux Distros Unpatched Vulnerability : CVE-2026-43002

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3. There is a write operation to the session storage backend before authentication and th...

CVE-2026-43002

An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3. There is a write operation to the session storage backend before authentication and thus storage can be exhausted by unauthenticated requests. This is a regression of the CVE-2014-8124 fix...

CVE-2026-43002

An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3. There is a write operation to the session storage backend before authentication and thus storage can be exhausted by unauthenticated requests. This is a regression of the CVE-2014-8124 fix...