11190 matches found
CVE-2026-51273
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
PT-2026-65532
In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow vulnerability exists in the ID3 tag parsing function showID3Tag of the embedded audio streaming library. The program reads untrusted long ID3 tag value from malicious audio files and uses unbounded appendf to write formatted strin...
SUSE SLES16 Security Update : joe (SUSE-SU-2026:22843-1)
The remote SUSE Linux SLES16 / SLESSAP16 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:22843-1 advisory. This update for joe fixes the following issue - CVE-2026-13412: improper validation in tag-file parser can lead to arbitrary command...
OSEC-2026-12 AEAD `decrypt_into` functions writes plaintext before checking the tag
On the generic GCM path, AES.GCM.authenticatedecryptinto as well as Chacha20.authenticatedecryptinto and AES.CCM16.authenticatedecryptinto writes the decrypted plaintext into the caller's destination buffer and only then compares the tag. On a forged tag the function returns false, but the...
CVE-2026-48052
Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, an authenticated user who is a member of any organization can delete or rename tags belonging to a different organization, given the target tag's ID. The route handler verifies the caller's membership of...
CVE-2026-48052 Papra: Cross-organization tag deletion and modification via authenticated cross-tenant request
Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, an authenticated user who is a member of any organization can delete or rename tags belonging to a different organization, given the target tag's ID. The route handler verifies the caller's membership of...
CVE-2026-48052
Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, an authenticated user who is a member of any organization can delete or rename tags belonging to a different organization, given the target tag's ID. The route handler verifies the caller's membership of...
CVE-2026-48052 Papra: Cross-organization tag deletion and modification via authenticated cross-tenant request
Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, an authenticated user who is a member of any organization can delete or rename tags belonging to a different organization, given the target tag's ID. The route handler verifies the caller's membership of...
EUVD-2026-49391
Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, an authenticated user who is a member of any organization can delete or rename tags belonging to a different organization, given the target tag's ID. The route handler verifies the caller's membership of...
CVE-2026-48052
CVE-2026-48052 affects Papra’s document management platform. Before version 26.5.0, an authenticated user who belongs to any organization could delete or rename tags belonging to a different organization. The URL contains the organizationId, but the repository write filter checked only tag.id, so...
CVE-2026-48052 Papra: Cross-organization tag deletion and modification via authenticated cross-tenant request
Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, an authenticated user who is a member of any organization can delete or rename tags belonging to a different organization, given the target tag's ID. The route handler verifies the caller's membership of...
GO-2026-6082 Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint in gitea.dev
Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint in gitea.dev...
CVE-2026-17574 NULL Pointer Dereference in HDF5 via Invalid Variable-Length Datatype Type Tag
HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-length datatype type field may cause the application to crash when the attribute is read...
Malicious Package
Overview @sqlite-tag/sql-creator is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...
Malicious code in @sqlite-tag/schema-generator (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6c0c9a31c77b90dcf433595d03bef3c4752075f134be6b4568dccf2751bc63d1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @sqlite-tag/sql-creator (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1a88585293f864e712b64feb436171caab5fc4d9c5d9d3509b2a0a67e04b6e8a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-11077 Malicious code in @sqlite-tag/sql-creator (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1a88585293f864e712b64feb436171caab5fc4d9c5d9d3509b2a0a67e04b6e8a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-11076 Malicious code in @sqlite-tag/schema-generator (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6c0c9a31c77b90dcf433595d03bef3c4752075f134be6b4568dccf2751bc63d1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
PT-2026-65083
Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, an authenticated user who is a member of any organization can delete or rename tags belonging to a different organization, given the target tag's ID. The route handler verifies the caller's membership of...