217672 matches found
CVE-2026-60369
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware component: Centralized Thirdparty Jars. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to...
CVE-2026-38763
An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to cause a denial of service via the function sub13828...
CVE-2026-38765
An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the kernel driver pgsecdl.sys...
GHSA-P9J2-GV94-2WF4 Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
Impact A rewrites or redirects rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the...
kernel: eventpoll: fix ep_remove struct eventpoll / struct file UAF
A flaw was found in the Linux kernel's eventpoll mechanism. A Use-After-Free UAF vulnerability, where the system attempts to access memory after it has been freed, can occur during the removal of a file. A local attacker could exploit this race condition to corrupt memory, potentially leading to...
Incorrect Authorization
Overview n8n is a n8n Workflow Automation Tool Affected versions of this package are vulnerable to Incorrect Authorization in the process that handles credential domain restrictions when user-supplied base or endpoint URLs are set. An attacker can exfiltrate credential secrets by configuring...
GHSA-G7HG-VRCF-MVMR Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator
Summary OcspServerCertificateValidator flags an out-of-date OCSP response but does not stop processing it, so an expired GOOD response is still reported as VALID, letting an on-path attacker replay a stale GOOD response to bypass revocation of a since-revoked certificate. Details In...
Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation
Summary Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has already exceeded maxHeaderSize and marked the frame truncated. At commit b2d2137c4404af425bf9d5d601a62576f5c06925, a 12,253-byte compressed SPDY header block can declare and inflat...
CVE-2025-50327
An issue in Franco Corbelli ZPAQFRANZ v.61.3 and before allows a remote attacker to escalate privileges and execute arbitrary code via a bypass of the Mark-of-the-Web protection mechanism...
golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input
A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...
MAL-2026-11000 Malicious code in application-util (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07fa5354b40e3efac6ff8738892aa26cb710e6aff3caca516f563502ef4a4d43 On npm install, scripts.postinstall runs test.js which performs three attacker-beneficial actions against the installer's host. 1 Backdoor: fetches a...
MAL-2026-11007 Malicious code in web3-terminal (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bff469765665422f3b9a6dd9978d99ddab9f853b02109f154c97b634977cf223 On npm install, package.json scripts.postinstall runs test.js, which invokes routines in index.js that 1 walk the current working directory for id.js...
MAL-2026-11002 Malicious code in habinger (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56e193021af7a2102362115c0e0f4564f90f3cf86a4e867b6f02ce266ba419e5 The package's postinstall hook package.json postinstall: node test.js auto-executes two malicious flows on npm install. First, on Linux it fetches an...
Malicious code in app-data-ist (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37bd61826219d14386d02eed926659dfcfcac94d7b414ae6dd6bcdd4a039fab3 On npm install, the package's postinstall hook node test.js auto-executes multiple attacker-controlled operations against the installer's machine. 1...
capstone: Capstone: Denial of Service vulnerability via crafted input
A flaw was found in the Capstone disassembly framework. This vulnerability, a null pointer dereference, can be exploited by a remote attacker. By providing a specially crafted input containing a specific 4-byte sequence during the disassembly of 3DNow! opcodes, the attacker can cause any...
CVE-2026-52584
A flaw was found in libjxl. This buffer overflow vulnerability allows a local attacker to obtain sensitive information. The flaw occurs within the DecodeImageAPNG function, which can lead to unauthorized disclosure of data. Mitigation Mitigation for this issue is either not available or the...
golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input
A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...
golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input
A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...
thrift: org.apache.thrift/libthrift: github.com/apache/thrift: Apache Thrift: Denial of Service via improper handling of highly compressed data
A flaw was found in Apache Thrift. This vulnerability, categorized as improper handling of highly compressed data also known as data amplification, allows a remote attacker to cause a Denial of Service DoS by sending specially crafted, highly compressed data. The affected component fails to...
golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input
A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...