5539 matches found
CVE-2026-31959
A flaw was found in Quill. This Server-Side Request Forgery SSRF vulnerability occurs when Quill attempts to fetch Apple notarization submission logs. An attacker, capable of tampering with API responses from Apple's notarization service e.g., in environments with TLS-intercepting proxies, can...
CVE-2026-31961
A flaw was found in Quill. An attacker can exploit this unbounded memory allocation vulnerability by providing a specially crafted Mach-O binary to Quill for processing. This malicious binary contains oversized values in its code signing structures, causing Quill to attempt to allocate excessive...
CVE-2026-31958
A flaw was found in tornado-python. A remote attacker can exploit this vulnerability by sending a specially crafted, very large multipart body with numerous parts. Because the parsing of these large bodies occurs synchronously on the main thread, it can consume excessive resources, leading to a...
CVE-2026-29777
A flaw was found in Traefik. A tenant with write access to an HTTPRoute resource can exploit this vulnerability by injecting specially crafted rule tokens into Traefik's router rule language through unsanitized header or query parameter match values. This allows the attacker to bypass listener...
Linux Distros Unpatched Vulnerability : CVE-2026-23907
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6. The ExtractEmbeddedFiles example...
Linux Distros Unpatched Vulnerability : CVE-2026-3923
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in WebMIDI in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...
CVE-2026-1965
A flaw was found in curl. When an application uses libcurl to make multiple Negotiate-authenticated HTTP or HTTPS requests to the same server with different credentials, libcurl may incorrectly reuse an existing connection. This logical error can cause a subsequent request to be sent using the...
CVE-2026-32102
OliveTin gives access to predefined shell commands from a web interface. In 3000.10.2 and earlier, OliveTin’s live EventStream broadcasts execution events and action output to authenticated dashboard subscribers without enforcing per-action authorization. A low-privileged authenticated user can...
CVE-2026-3805
A flaw was found in curl. When handling a second Server Message Block SMB request to the same host, curl incorrectly accesses memory that has already been freed. This memory corruption vulnerability, known as a use-after-free, could allow a remote attacker to potentially execute arbitrary code or...
CVE-2026-28292
A vulnerability was discovered in the simple-git Node.js library. The issue is caused by improper validation of user-supplied input when constructing Git commands. An attacker able to supply specially crafted repository URLs or arguments could exploit Git’s ext:: protocol handler to execute...
CVE-2026-2742
A flaw was found in com.vaadin/flow-server. This authentication bypass vulnerability allows an unauthenticated attacker to bypass security filters by accessing the /VAADIN endpoint without a trailing slash. This inconsistent path pattern matching enables the attacker to trigger framework...
CVE-2026-31812
A flaw was found in quinn-proto, a pure-Rust implementation of the IETF QUIC transport protocol. A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quictransportparameters...
Linux Distros Unpatched Vulnerability : CVE-2026-26131
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect default permissions in .NET allows an authorized attacker to elevate privileges locally. CVE-2026-26131 Note that Nessus relies on the presence of the...
Linux Distros Unpatched Vulnerability : CVE-2026-3805
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory. CVE-2026-3805 Note that Nessus...
CVE-2026-31808
A flaw was found in file-type, a library for detecting file types. A remote attacker can exploit this by providing a specially crafted ASF Advanced Systems Format file. When parsing the file, a zero-sized sub-header can trigger an infinite loop, leading to a Denial of Service DoS. This can stall...
CVE-2026-31817
A flaw was found in OliveTin. When the saveLogs feature is enabled, an attacker can exploit a directory traversal vulnerability by manipulating the UniqueTrackingId field in the StartAction API request. This allows the attacker to write files to arbitrary locations on the filesystem, potentially...
CVE-2026-30951
A flaw was found in Sequelize, a Node.js Object-Relational Mapper ORM tool. A remote attacker can exploit a SQL injection vulnerability by manipulating JSON object keys during JSON/JSONB where clause processing. This allows for the injection of arbitrary SQL commands due to the improper handling ...
CVE-2026-23868
A flaw was found in giflib. This double-free vulnerability, caused by a shallow copy in GifMakeSavedImage and incorrect error handling, may allow an attacker to corrupt memory. While difficult to trigger, successful exploitation could potentially lead to arbitrary code execution or a denial of...
CVE-2026-30964
A flaw was found in web-auth/webauthn-lib. The CheckAllowedOrigins function, when configured with allowedorigins, incorrectly processes URL-like values by reducing them to their host component. This behavior ignores scheme and port differences, preventing the enforcement of precise origin policie...
