7127 matches found
EUVD-2026-38387
MessagePack for C is a MessagePack serializer for C. Prior to 2.5.301 and 3.1.7, the parameterless MessagePackInputFormatter constructor uses default serializer options, which resolve to MessagePackSerializerOptions.Standard with MessagePackSecurity.TrustedData. The formatter is designed for...
EUVD-2026-38385
MessagePack for C is a MessagePack serializer for C. Prior to 2.5.301 and 3.1.7, ExpandoObjectFormatter.Deserialize populates System.Dynamic.ExpandoObject by calling IDictionary.Add for each map entry. ExpandoObject internally maintains member names in array-like structures, so inserting many...
CVE-2026-48511
The CVE affects MessagePack for C# (MessagePack-CSharp) prior to versions 2.5.301 and 3.1.7. The issue lies in ExpandoObjectFormatter.Deserialize, which populates System.Dynamic.ExpandoObject by repeatedly calling IDictionary.Add for each map entry. ExpandoObject stores member names in array-like...
EUVD-2026-38380
MessagePack for C is a MessagePack serializer for C. Prior to 2.5.301 and 3.1.7, InterfaceLookupFormatter constructs an internal Dictionary with the default equality comparer instead of the security-aware comparer supplied by options.Security.GetEqualityComparer. This formatter omission allows...
CVE-2026-48516
MessagePack-CSharp vulnerable in the InterfaceLookupFormatter before versions 2.5.301 and 3.1.7 , which constructs an internal Dictionary with the default equality comparer rather than the security-aware comparer from options.Security.GetEqualityComparer(). This omission enables a hash-collision ...
CVE-2026-12862
Untrusted user data was passed verbatim to Excel exports for administrators. This allowed formula injection which can be used to compromise the environment of the user loading the file or other data in the file...
CVE-2026-12862 XLSX formula injection in exports
Untrusted user data was passed verbatim to Excel exports for administrators. This allowed formula injection which can be used to compromise the environment of the user loading the file or other data in the file...
EUVD-2026-38220
Untrusted user data was passed verbatim to Excel exports for administrators. This allowed formula injection which can be used to compromise the environment of the user loading the file or other data in the file...
CVE-2026-12862
The CVE-2026-12862 entry documents a formula-injection risk in XLSX exports where untrusted user data is passed directly to Excel exports for administrators. Root cause: untrusted data used in the export path enables Excel formulas to be interpreted when the file is opened, potentially compromisi...
CVE-2026-56355
GNU Savannah Administration Savane through 3.17 uses untrusted data as part of authorization...
CVE-2026-56355
GNU Savannah Administration Savane through 3.17 uses untrusted data as part of authorization...
EUVD-2026-38135
GNU Savannah Administration Savane through 3.17 uses untrusted data as part of authorization...
CVE-2026-56355
GNU Savannah Administration Savane through 3.17 uses untrusted data as part of authorization...
CVE-2026-56355
CVE-2026-56355 affects GNU Savannah Administration Savane up to version 3.17. The connected documents describe an authorization issue caused by using untrusted data in the authorization path. No explicit exploit vectors, impact details, or remediation/fixes are provided in the documents. Technica...
CVE-2026-56317
Nuxt before 4.4.7 and the 3.x branch before 3.21.7 contains a cross-site scripting vulnerability in the NoScript component that writes slot content to innerHTML without escaping. Attackers can inject malicious scripts through untrusted data in NoScript slots, such as route.query parameters, which...
CVE-2026-56317
Nuxt is affected by CVE-2026-56317: a cross-site scripting flaw in the NoScript component present in Nuxt < 4.4.7 (and 3.x
CVE-2026-48129
Kestra is an open-source, event-driven orchestration platform. Prior to versions 1.3.19, 1.2.19, 1.1.19, and 1.0.43, Kestra task inputFiles writes rendered file names directly under the task working directory. When a flow forwards untrusted execution or webhook data into an inputFiles file name, ...
CVE-2026-48129
Kestra CVE-2026-48129 concerns a path traversal in the task inputFiles feature. Before versions 1.3.19, 1.2.19, 1.1.19, and 1.0.43, rendered file names could be prefixed with ../, allowing a caller handling untrusted data or webhook data to create or overwrite files outside the task working direc...
CVE-2026-8024
A remote, unauthenticated attacker may exploit a deserialization of untrusted data vulnerability in ibaPDA or ibaDatCoordinator to gain full access to the affected systems...
CVE-2026-8024 Deserialization vulnerability in ibaPDA and ibaDatCoordinator
A remote, unauthenticated attacker may exploit a deserialization of untrusted data vulnerability in ibaPDA or ibaDatCoordinator to gain full access to the affected systems...