217510 matches found
CVE-2026-42495
This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them:...
ALPINE-CVE-2026-42495
This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them:...
CVE-2026-42495
This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them:...
CVE-2026-46428
A flaw was found in lettre, a mailer library for Rust. An inverted-boolean bug in the boring-tls integration silently disables TLS hostname verification for users employing the default strict configuration. A remote on-path attacker can exploit this by presenting any valid TLS certificate, allowi...
gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb
A heap buffer overflow vulnerability was found in GStreamer's librfb RFB/VNC client. The rectangle bounds check incorrectly validates area rather than individual dimensions, allowing a malicious VNC server to send a rectangle that extends beyond the framebuffer. A remote attacker could set up a...
CVE-2026-66918 DOM-Based Cross-Site Scripting via Unsanitized SVG Node Icons
Pivotick fails to sanitize attacker-controlled SVG markup supplied through the per-node style.svgIcon property before inserting it into the document. When rendering a graph node, the vulnerable code assigns the SVG icon markup directly to the innerHTML property of a live SVG element. An attacker...
EUVD-2026-49792
Pivotick fails to sanitize attacker-controlled SVG markup supplied through the per-node style.svgIcon property before inserting it into the document. When rendering a graph node, the vulnerable code assigns the SVG icon markup directly to the innerHTML property of a live SVG element. An attacker...
CVE-2026-66918 DOM-Based Cross-Site Scripting via Unsanitized SVG Node Icons
Pivotick fails to sanitize attacker-controlled SVG markup supplied through the per-node style.svgIcon property before inserting it into the document. When rendering a graph node, the vulnerable code assigns the SVG icon markup directly to the innerHTML property of a live SVG element. An attacker...
CVE-2026-66918
Pivotick contains a DOM-based XSS vulnerability where per-node style.svgIcon SVG markup is assigned to innerHTML without sanitization. The vulnerable code can render attacker-controlled SVGs that include executable event handlers (e.g., onerror on an ), enabling arbitrary JavaScript in the victim...
CVE-2026-62424
CVE-2026-62424 affects the libfsimage iso9660 driver (Rock Ridge NM record processing). Attacker-controlled on-disk fields derive several lengths without validation, with potential underflow in System Use/Rock Ridge length handling, and specifically NM record processing may rely on a good entry l...
EUVD-2026-49776
This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them:...
CVE-2026-42495
This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them:...
CVE-2026-42494
This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them:...
CVE-2026-62425 buffer overruns in libfsimage iso9660 handling
This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them:...
CVE-2026-42495 buffer overruns in libfsimage iso9660 handling
This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them:...
EUVD-2026-49775
This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them:...
CVE-2026-62424
This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them:...
CVE-2026-62425
CVE-2026-62425 affects the libfsimage iso9660 driver, where the Rock Ridge CE record processing derives several lengths directly from attacker-controlled on-disk fields without validation. The vulnerability arises because the Rock Ridge CE handling assumes a good size and offset, enabling manipul...
CVE-2026-64223
A flaw was found in the Linux kernel's mac80211 Wi-Fi driver. This vulnerability, an out-of-bounds read, occurs when parsing negotiated Time-To-Live Map TTLM elements. A remote attacker could craft a sparse map, causing the parser to read beyond the intended memory boundary. While direct policy...
CVE-2026-16774 WPBot <= 8.5.9 - Missing Authorization to Unauthenticated Email Relay via wpcs_send_email AJAX Action
The Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.5.9 via the wpcssendemail AJAX handler. This is due to the wpcssendemail function being registered on both wpajaxwpcssendemail and wpajaxnoprivwpcssendemail with no nonce verification,...