24999 matches found
SUSE CVE-2026-90831
A vulnerability was detected in GNU Binutils 2.47. The affected element is the function bfdelfstrtabdelref of the file bfd/elf-strtab.c of the component ELF String Table. The manipulation results in memory corruption. The attack requires a local approach. The exploit is now public and may be used...
CVE-2026-92255
Netcore NR255-V version 1.5.130703 contains an out-of-bounds read vulnerability in filterarpputfile.cgi caused by improper use of a string handling API. Attackers can trigger an unterminated buffer over-read by exploiting this flaw in the affected component, potentially exposing adjacent memory...
CVE-2026-92255
Netcore NR255-V router version 1.5.130703 contains an out-of-bounds read vulnerability in filter_arp_put_file.cgi, caused by improper use of a string handling API that leads to an unterminated buffer over-read. An authenticated attacker (low privileges) over the network can trigger the flaw, pote...
CVE-2026-92255 Netcore NR255-V 1.5.130703 Out-of-Bounds Read in filter_arp_put_file.cgi via String API Misuse
Netcore NR255-V version 1.5.130703 contains an out-of-bounds read vulnerability in filterarpputfile.cgi caused by improper use of a string handling API. Attackers can trigger an unterminated buffer over-read by exploiting this flaw in the affected component, potentially exposing adjacent memory...
CVE-2026-32599
Netmaker makes networks with WireGuard. Prior to version 1.5.0, the sqliteDeleteRecord function in Netmaker's database layer constructs SQL DELETE statements using direct string concatenation of user-supplied input. This allows an authenticated attacker to perform boolean-based SQL injection...
CVE-2026-32599 Netmaker has a boolean‑based SQL Injection
Netmaker makes networks with WireGuard. Prior to version 1.5.0, the sqliteDeleteRecord function in Netmaker's database layer constructs SQL DELETE statements using direct string concatenation of user-supplied input. This allows an authenticated attacker to perform boolean-based SQL injection...
CVE-2026-32599 Netmaker has a boolean‑based SQL Injection
Netmaker makes networks with WireGuard. Prior to version 1.5.0, the sqliteDeleteRecord function in Netmaker's database layer constructs SQL DELETE statements using direct string concatenation of user-supplied input. This allows an authenticated attacker to perform boolean-based SQL injection...
CVE-2026-32599
Netmaker (a WireGuard network manager) is vulnerable to boolean-based SQL injection in its SQLite database layer. Prior to version 1.5.0 , the sqliteDeleteRecord function builds SQL DELETE statements via direct string concatenation of user-supplied input from the DELETE /api/dns/{network}/{domain...
CVE-2026-32599 Netmaker has a boolean‑based SQL Injection
Netmaker makes networks with WireGuard. Prior to version 1.5.0, the sqliteDeleteRecord function in Netmaker's database layer constructs SQL DELETE statements using direct string concatenation of user-supplied input. This allows an authenticated attacker to perform boolean-based SQL injection...
Netmaker has a boolean‑based SQL Injection
SQL Injection in Netmaker SQLite Database Backend Summary The sqliteDeleteRecord function in Netmaker's database layer constructs SQL DELETE statements using direct string concatenation of user-supplied input. This allows an authenticated attacker to perform boolean-based SQL injection. --- Detai...
CVE-2026-55375
canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams places appid, appsecret, refreshtoken, and code in the URL query string of token POST requests, allowing access logs, proxy logs, and APM traces to persist the credential...
CVE-2026-55375
canto-saas-api (PHP library for the Canto SaaS API) prior to 3.0.0 sends OAuth credentials (app_id, app_secret, refresh_token, code) in the URL query string of token POST requests rather than the request body. Because request URLs are commonly recorded in access logs, proxy logs, and APM traces, ...
EUVD-2026-78902
canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams places appid, appsecret, refreshtoken, and code in the URL query string of token POST requests, allowing access logs, proxy logs, and APM traces to persist the credential...
CVE-2026-55375 canto-saas-api: OAuth credentials exposed in URL query string and exception messages
canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams places appid, appsecret, refreshtoken, and code in the URL query string of token POST requests, allowing access logs, proxy logs, and APM traces to persist the credential...
CVE-2026-55375 canto-saas-api: OAuth credentials exposed in URL query string and exception messages
canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams places appid, appsecret, refreshtoken, and code in the URL query string of token POST requests, allowing access logs, proxy logs, and APM traces to persist the credential...
CVE-2026-55375 canto-saas-api: OAuth credentials exposed in URL query string and exception messages
canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams places appid, appsecret, refreshtoken, and code in the URL query string of token POST requests, allowing access logs, proxy logs, and APM traces to persist the credential...
EUVD-2026-78889
Apptainer is an open source container platform. Prior to version 1.5.1, Image.AuthorizedPath applies plain string-prefix matching to the limit container paths directive in apptainer.conf, so an allowed path such as /data/safe also authorizes a sibling path such as /data/safe-but-unsafe. A local...
CVE-2026-48785 Apptainer: Incorrect path matching for 'limit container paths' directive
Apptainer is an open source container platform. Prior to version 1.5.1, Image.AuthorizedPath applies plain string-prefix matching to the limit container paths directive in apptainer.conf, so an allowed path such as /data/safe also authorizes a sibling path such as /data/safe-but-unsafe. A local...
CVE-2026-91983 Vikunja before 2.6.0 API Token Scope Bypass via expand Parameter
Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fails to inspect query string parameters. Attackers with limited token scopes can use the expand parameter to access restricted data like comments, reactions, and time entries without...
CVE-2026-91983
Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fails to inspect query string parameters. Attackers with limited token scopes can use the expand parameter to access restricted data like comments, reactions, and time entries without...