214388 matches found
CVE-2026-55814
A flaw was found in Apache Ranger. This vulnerability allows a remote attacker to access sensitive plugin data through the download APIs without requiring any authentication. This unauthorized access can lead to information disclosure, potentially exposing critical configuration or operational...
CVE-2026-63623
A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the qemu-img utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents...
EUVD-2026-55636
Affected versions of MISP cti-transmute disclose users' email addresses through the account following-list endpoint. When an authenticated user follows another account, getfollowing includes the followed user's email field in the API response alongside their name, user ID, and follow date. Becaus...
CVE-2026-18503
Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff...
CVE-2026-18503
Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff...
CVE-2026-18503 Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()
Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff...
UBUNTU-CVE-2026-68100
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate numsubauth when copying ACE in setntacldacl setntacldacl copies each ACE from the attacker-controlled stored security descriptor verbatim into the response DACL without checking sid.numsubauth. The ACE bytes...
CVE-2026-68100
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate numsubauth when copying ACE in setntacldacl setntacldacl copies each ACE from the attacker-controlled stored security descriptor verbatim into the response DACL without checking sid.numsubauth. The ACE bytes...
CVE-2026-58042
A denial of service DoS vulnerability in Node.js allows a remote attacker to crash the application. By sending a specially crafted DNS response with an excessive number of 'A' records, an attacker can cause the dns.resolveAny function to unexpectedly abort the process. Mitigation If unused, avoid...
FFmpeg: FFmpeg: Arbitrary code execution, information disclosure, or denial of service via crafted ADX/AAX audio files
A flaw was found in FFmpeg. A remote attacker could exploit an out-of-bounds memory access vulnerability in the ADX audio decoder by supplying a specially crafted ADX or AAX audio file. This could lead to the attacker triggering both out-of-bounds reads and writes, potentially resulting in...
Malicious code in postcss-initial-provider (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e88db5eb44ddcfa3cd22d46e8b6e6a1cd2e7da25a5942d35550d50f2cbbb9ea3 index.js contains a unicode-escape-obfuscated block that runs when the package is required. It queries public Ethereum RPC endpoints 1rpc.io/eth,...
CVE-2026-59088
A flaw was found in GIMP. A signed integer overflow vulnerability exists in the file-fli plugin when processing FLI image files. This occurs due to an incorrect calculation during memory allocation for image buffers, where the multiplication of image width and height can exceed the maximum intege...
EUVD-2026-55535
A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to irreversibly decline any in-flight document and forge the decline attribution to an arbitrary user via the declinedoc Parse cloud function. The function writes...
CVE-2026-72692
A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to irreversibly decline any in-flight document and forge the decline attribution to an arbitrary user via the declinedoc Parse cloud function. The function writes...
CVE-2026-72691 OpenSignLabs opensignserver - Authentication Bypass
An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to mint MASTERKEY-signed file access tokens for arbitrary stored files via the getsignedurl Parse cloud function. The function skips its isAuthenticated check whenever an...
CVE-2026-68100
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate numsubauth when copying ACE in setntacldacl setntacldacl copies each ACE from the attacker-controlled stored security descriptor verbatim into the response DACL without checking sid.numsubauth. The ACE bytes...
Malicious code in tokocrytodev (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88f51898e05da09842f561ce72f06378a6718f778fa0335b68bb4c0fda8cc5a6 On module load, tokocrytodev instantiates a StealthC2 agent and starts a polling loop that fetches commands from...
MAL-2026-13687 Malicious code in tokocrytodev (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88f51898e05da09842f561ce72f06378a6718f778fa0335b68bb4c0fda8cc5a6 On module load, tokocrytodev instantiates a StealthC2 agent and starts a polling loop that fetches commands from...
CVE-2026-72590
An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the envvars parameter...