247299 matches found
MGASA-2026-0185 Updated minetest packages fix security vulnerabilities
Mod security sandbox escape. CVE-2026-40959 HTTP API and insecure environment access control bypass. CVE-2026-40960...
EUVD-2026-35902
Spring Data Commons contains a vulnerability that can lead to a Denial of Service DoS condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPayload, when an attacker sends a specially crafted HTTP request that causes the application to allocate lo...
GHSA-5M4M-73W9-8433 Spring Data Commons: Denial of Service via excessive memory allocation in projection binding
Spring Data Commons contains a vulnerability that can lead to a Denial of Service DoS condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPayload, when an attacker sends a specially crafted HTTP request that causes the application to allocate lo...
Spring Data Commons: Denial of Service via excessive memory allocation in projection binding
Spring Data Commons contains a vulnerability that can lead to a Denial of Service DoS condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPayload, when an attacker sends a specially crafted HTTP request that causes the application to allocate lo...
EUVD-2026-35845
CAI Content Credentials versions [email protected], c2pa-v0.80.1 and earlier are affected by an Uncontrolled Resource Consumption vulnerability. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this iss...
EUVD-2026-35850
CAI Content Credentials versions [email protected], c2pa-v0.80.1 and earlier are affected by an Integer Overflow or Wraparound vulnerability. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require...
CVE-2026-41721
Spring Data Commons contains a vulnerability that can lead to a Denial of Service DoS condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPayload, when an attacker sends a specially crafted HTTP request that causes the application to allocate lo...
PT-2026-48410
Name of the Vulnerable Software and Affected Versions Ghidra versions prior to 12.1 Description On Windows, improper escaping of cmd.exe metacharacters in URL annotation handling allows for command injection. This occurs when malicious URLs are embedded in program comments; if a user clicks these...
PT-2026-48500
In Splunk SOAR Security Orchestration, Automation, and Response versions below 8.5.0, an unauthenticated attacker could inject American National Standards Institute ANSI escape codes into SOAR application log files through specially crafted HTTP request paths, which a terminal emulator might...
cve-2026-40985 - MEDIUM - Data Binding Vulnerability in Spring Web Flow with Unified EL Parser
cve-2026-40985 - MEDIUM - Data Binding Vulnerability in Spring Web Flow with Unified EL Parser...
Server-side Request Forgery (SSRF)
Overview org.springframework.ws:spring-ws-core is a product of the Spring community focused on creating document-driven Web services. Spring Web Services aims to facilitate contract-first SOAP service development, allowing for the creation of flexible web services using one of the many ways to...
PT-2026-48460
Name of the Vulnerable Software and Affected Versions Roxy-WI versions prior to 8.2.6.5 Description A path-traversal issue exists in the web interface used for managing Haproxy, Nginx, Apache, and Keepalived servers. A security check implemented in the config.py file within the app/modules/config...
PT-2026-48488
Name of the Vulnerable Software and Affected Versions PAN-OS versions 10.2 affected versions not specified PAN-OS versions 11.1 affected versions not specified PAN-OS versions 11.2 affected versions not specified PAN-OS versions 12.1 affected versions not specified Description A command injection...
Уязвимость технологии WebRTC браузеров Google Chrome и Microsoft Edge, позволяющая нарушителю выполнить произвольный код
Уязвимость технологии WebRTC браузеров Google Chrome и Microsoft Edge связана с использованием памяти после ее освобождения. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код...
The vulnerability of the formAddWebAuthUser() function in the Tenda W15E router software allows a hacker to trigger a service failure.
The vulnerability of the formAddWebAuthUser function in the Tenda W15E router’s microprogramming software is related to the issue of the operation going beyond the buffer in memory when processing the webAuthUserPwd parameter. Exploiting this vulnerability could allow a malicious actor to cause...
EulerOS 2.0 SP13 : libsoup (EulerOS-SA-2026-2341)
According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in...
Fission 路径遍历漏洞
Fission is an open-source function deployment framework based on Kubernetes. Versions of Fission prior to 1.25.0 contained a path traversal vulnerability. This vulnerability stemmed from the Unarchive function using filepath.Join to concatenate the archive entry name with the target directory,...
sharp 安全漏洞
Sharp is a personal development tool by Lovell, designed to convert large images in common formats into smaller, web-friendly JPEG, PNG, WebP, GIF, and AVIF images. Versions of Sharp prior to 9.22.0 contained a security vulnerability. This vulnerability stemmed from the general download endpoint...
VMware Spring Data Commons 资源管理错误漏洞
VMware Spring Data Commons is a data access abstraction framework developed by VMware Corporation in the United States. Vulnerabilities exist in versions 4.0.0 and earlier, as well as versions 3.5.0 and earlier, 3.4.0 and earlier, 3.3.0 and earlier, 3.2.0 and earlier, 3.1.0 and earlier, 3.0.0 and...