3887 matches found
EUVD-2026-14565
OpenClaw before 2026.3.1 contains an unbounded memory growth vulnerability in the Zalo webhook endpoint that allows unauthenticated attackers to trigger memory exhaustion by varying query strings. Attackers can send repeated requests with different query parameters to the same webhook route,...
Rails Active Support has a possible ReDoS vulnerability in number_to_delimited
Impact NumberToDelimitedConverter used a regular expression with gsub! to insert thousands delimiters. This could produce quadratic time complexity on long digit strings. Releases The fixed releases are available at the normal locations. Credit This issue was responsibly reported by Hackerone...
Improper Encoding or Escaping of Output
Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in the processing of gRPC requests received from Envoy when the path contains a query string. An attacker can cause incorrect path handling by sending specially crafted requests with query strings...
Xlinesoft ASPRunner.NET 安全漏洞
XLineSoft Xlinesoft ASPRunner.NET is a web application development tool provided by the American company XLineSoft. Version 10.1 of Xlinesoft ASPRunner.NET contains a security vulnerability. This vulnerability stems from a denial-of-service vulnerability in table name fields, which could allow...
UltraVNC Viewer 缓冲区错误漏洞
UltraVNC Viewer is a remote desktop client developed by UltraVNC Corporation. Version 1.2.2.4 of UltraVNC Viewer contains a buffer error vulnerability. This vulnerability stems from a denial-of-service attack on the VNC Server’s input fields, which could allow attackers to cause the application t...
GSearch 安全漏洞
GSearch is a third-party application released by GSearch Inc. on the Microsoft Store. Version GSearch 1.0.1.0 contains a security vulnerability. This vulnerability stems from a denial-of-service vulnerability in the search bar, which could allow local attackers to cause the application to crash b...
jetAudio 安全漏洞
JetAudio is a multimedia player software developed by the JetAudio company. The Basic version of JetAudio 8.1.7.20702 contains a security vulnerability. This vulnerability stems from a denial-of-service vulnerability in the URL processing mechanism, which could allow local attackers to cause the...
TuneClone 缓冲区错误漏洞
TuneClone is an audio conversion tool developed by the TuneClone company. Version 2.20 of TuneClone contains a buffer error vulnerability, which stems from a buffer overflow in the structured exception handler. This vulnerability could allow local attackers to execute arbitrary code by providing...
XLineSoft PHPRunner 安全漏洞
XLineSoft PHPRunner is a development tool developed by XLineSoft Corporation in the United States. It is used for quickly creating data-driven web applications based on PHP. Version XLineSoft PHPRunner 10.1 contains a security vulnerability. This vulnerability stems from a denial-of-service...
Nsasoft Backup Key Recovery 安全漏洞
Nsasoft Backup Key Recovery is a product key recovery software developed by the US company Nsasoft. Version 2.2.4 of Nsasoft Backup Key Recovery contains a security vulnerability. This vulnerability stems from a denial-of-service vulnerability in the Name field, which could allow local attackers ...
Malicious code in shakti-strings (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f2263a09a764a00c111f0baad35ef067d15ac1baaf92efd30cf27d86a4adc66 The package shakti-strings was found to contain malicious code. Source: ossf-package-analysis...
MAL-2026-2003 Malicious code in shakti-strings (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f2263a09a764a00c111f0baad35ef067d15ac1baaf92efd30cf27d86a4adc66 The package shakti-strings was found to contain malicious code. Source: ossf-package-analysis...
OESA-2026-1699 golang security update
The Go Programming Language. Security Fixes: The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large...
OESA-2026-1698 golang security update
The Go Programming Language. Security Fixes: The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large...
CVE-2026-30873 OpenWrt Project jsonpath: Memory leak when processing strings, labels, and regexp tokens
OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to both 24.10.6 and 25.12.1, the jpgettoken function, which performs lexical analysis by breaking input expressions into tokens, contains a memory leak vulnerability when extracting string literals, field...
httpd: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=...
A server side include handling flaw has been discovered in the Apache HTTP server. When Server Side Includes SSI areenabled and modcgid but not modcgi passes the shell-escaped query string to exec cmd="..." directives an attacker may be able to inject commands executed by the server...
EUVD-2026-13014
OpenClaw versions prior to 2026.3.1 contain an unbounded memory growth vulnerability in the Zalo webhook endpoint that allows unauthenticated attackers to trigger in-memory key accumulation by varying query strings. Remote attackers can exploit this by sending repeated requests with different que...
CVE-2026-28461
OpenClaw
CVE-2026-28461 OpenClaw < 2026.3.1 - Unbounded Memory Growth in Zalo Webhook via Query String Key Churn
OpenClaw versions prior to 2026.3.1 contain an unbounded memory growth vulnerability in the Zalo webhook endpoint that allows unauthenticated attackers to trigger in-memory key accumulation by varying query strings. Remote attackers can exploit this by sending repeated requests with different que...