164393 matches found
Important: gvfs
Issue Overview: A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause readreply to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buff...
CVE-2024-31027: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting vulnerability in Greek Universities Network GUnet Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the last name, first name, and username parameters in the user registration functionality...
CVE-2026-102327: Incorrect Authorization
Incorrect authorization in WebView in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Low...
PT-2026-102839
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 154.0.8037.92 Description A use after free issue exists in the Bluetooth component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption. A remote...
PT-2026-102860
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 154.0.8037.92 Description A type confusion issue exists in V8, the open-source JavaScript and WebAssembly engine. This flaw allows a remote attacker to execute arbitrary code within the sandbox by inducing the...
PT-2026-102855
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 154.0.8037.92 Description A type confusion issue exists in V8, the open-source JavaScript and WebAssembly engine. This flaw allows a remote attacker to execute arbitrary code within the sandbox by inducing the...
CVE-2026-102321: Access of Resource Using Incompatible Type
Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-102323: Access of Resource Using Incompatible Type
Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-101169: Deserialization of Untrusted Data
In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecure deserialization of this content allows the user to execute arbitrary code in the Octopus Server process...
PT-2026-102493
Name of the Vulnerable Software and Affected Versions U-Boot versions prior to 2026.07 Description When configured with the CONFIG IP DEFRAG=y parameter, the software fails to clear the IP reassembly state after delivering a complete datagram. This allows an attacker capable of delivering...
FreeBSD: VID-bd24bc14-b9a9-11f1-bf98-a8a1599412c6 (CVE-2026-95365): chromium -- security fixes
Type confusion in IndexedDB in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-91191: Improper Verification of Cryptographic Signature
The device's update mechanism includes conditions that allow unauthorized software packages to be accepted as authentic. During the boot process, the stock done function disables signature verification in the OPKG configuration before restoring optional packages from a writable, unsigned feed...
PT-2026-102936
Name of the Vulnerable Software and Affected Versions LightLLM versions prior to 1.2.1 Description Multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces. This allows attackers to send crafted serialized objects to exposed cache...
CVE-2026-103041: Deserialization of Untrusted Data
LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces. Attackers can send crafted serialized objects to exposed cache methods to execute arbitrary code with service privileges...
CVE-2026-92368: Heap-based Buffer Overflow
TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session recording files. A size mismatch during decompression of recorded session data can result in out-of-bounds heap writes. By convincing a user...
CVE-2024-31027
Cross Site Scripting vulnerability in Greek Universities Network GUnet Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the last name, first name, and username parameters in the user registration functionality...
PT-2026-102883
An issue in Kilo Code before v7.4.1 allows a local attacker to execute arbitrary code via the permission/allow-everything endpoint...
ROS-20260929-73-0036
The vulnerability of the dwc3removerequests function in Linux operating system kernels is related to the situation of signal handling. Exploiting this vulnerability can allow an attacker to cause service failures or execute arbitrary code...
FreeBSD: VID-bd24bc14-b9a9-11f1-bf98-a8a1599412c6 (CVE-2026-95306): chromium -- security fixes
Type confusion in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
