ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass

A flaw was found in ASP.NET Core. An authorized attacker can exploit this authentication bypass vulnerability over a network by manipulating assumed-immutable data. This can allow the attacker to elevate their privileges within the system...

dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation

A flaw was found in .NET where uncontrolled resource allocation can be exploited by an unauthorized attacker over a network. This vulnerability allows the attacker to exhaust available resources, leading to a Denial of Service DoS condition. The lack of limits or throttling mechanisms enables an...

dotnet: .NET Core: Denial of Service via type confusion

A flaw was found in .NET Core. This vulnerability, known as type confusion, allows an unauthorized remote attacker to cause a denial of service DoS over a network. By exploiting this flaw, an attacker can make the affected system unavailable to legitimate users...

ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation

A flaw was found in ASP.NET Core. This vulnerability allows an unauthorized remote attacker to cause a Denial of Service DoS by allocating resources without proper limits or throttling. This can lead to the affected system becoming unresponsive or unavailable to legitimate users...

dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation

A flaw was found in .NET where uncontrolled resource allocation can be exploited by an unauthorized attacker over a network. This vulnerability allows the attacker to exhaust available resources, leading to a Denial of Service DoS condition. The lack of limits or throttling mechanisms enables an...

The vulnerability of the Content Credentials SDK libraries, related to insufficient validation of input data, allows attackers to trigger service failures.

The vulnerability of the Content Credentials SDK libraries is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to cause service failures...

PT-2026-61740

Name of the Vulnerable Software and Affected Versions Grav CMS scheduler-webhook plugin affected versions not specified Description An authentication bypass exists in the scheduler-webhook plugin due to a short-circuit logic flaw during webhook token validation. This allows unauthenticated remote...

OESA-2026-3026 xorg-x11-server security update

X.Org X11 X server Security Fixes: Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a heap buffer overflow via SetFont due to missing glyph boundary checks.CVE-2026-55999...

EUVD-2026-45405

QueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid session tokens for existing accounts by submitting a signup request with a known victim email address. The signup route unconditionally creates and links a new token to the matching...

CVE-2025-71396

The vulnerability CVE-2025-71396 affects SurrealDB prior to 2.0.5, 2.1.x prior to 2.1.5, and 2.2.x prior to 2.2.2 where the default execution-time limit for embedded JavaScript functions is not enforced when scripting is explicitly enabled (via --allow-scripting or --allow-all). An authenticated ...

CVE-2025-71393 SurrealDB before 2.2.2 Memory Exhaustion via Nested Functions

SurrealDB before 2.2.2 with scripting enabled fails to properly enforce recursion limits when native functions contain embedded JavaScript that issues new queries. Authenticated attackers can bypass the recursion limit by chaining native and JavaScript function calls to trigger infinite recursion...

CVE-2024-58370 SurrealDB before 1.1.0 Uncontrolled Recursion Denial of Service

SurrealDB versions before 1.1.0 fail to enforce recursion depth limits when parsing nested SurrealQL statements including IF, RELATE, and attribute access idioms. Authorized attackers can submit queries with excessive nesting depth to cause stack overflow and crash the server...

EUVD-2026-45361

VMware Avi Load Balancer contains an authorization bypass vulnerability. A malicious actor on the network can access a limited subset of the Avi Control Plane without proper authorization. Affected versions: 32.1.1 fixed in 32.1.2 31.1.1 through 31.2.2 fixed in 31.2.2-2p3 30.1.1 through 30.2.6...

CVE-2026-9734

The W3SC Elementor to Zoho CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to missing or incorrect nonce validation on the storeInfo function. This makes it possible for unauthenticated attackers to modify the plugin's...

GO-2026-5939 Claircore: Unauthenticated attackers can submit manifests with URIs pointing to internal services or cloud metadata endpoints in github.com/quay/claircore

Claircore: Unauthenticated attackers can submit manifests with URIs pointing to internal services or cloud metadata endpoints in github.com/quay/claircore...

CVE-2026-15093 Multiple Vulnerabilities in IBM Engineering AI hub.

IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to redirect users to malicious websites due to improper validation of user-supplied URLs...

CVE-2026-47183

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.6, DNSIncoming.logexceptiondebug and the four QuietLogger exception-dedup methods stored an unbounded seenlogs dictionary keyed by attacker-influenced IncomingDecodeError messages, retaining sys.excinfo...

CVE-2026-47183

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.6, DNSIncoming.logexceptiondebug and the four QuietLogger exception-dedup methods stored an unbounded seenlogs dictionary keyed by attacker-influenced IncomingDecodeError messages, retaining sys.excinfo...

Improper Enforcement Of Security Policy

github.com/forgekeep/nebula-mesh is vulnerable to Improper Enforcement of Security Policy. The vulnerability is due to the Web UI host-creation endpoint hardcoding a 24-hour enrollment token lifetime instead of enforcing the configured server-wide or per-network enrollment token TTL, which allows...

CVE-2026-9810

The AI Copilot WordPress plugin before 1.5.4 does not bind OAuth access tokens to a WordPress user, and accepts any valid token as an administrator session, allowing unauthenticated attackers who complete the public OAuth flow to execute privileged MCP tools as an administrator, including arbitra...