Lucene search
+L

4389 matches found

EUVD
EUVD
added 2026/07/03 6:18 a.m.14 views

EUVD-2026-41495

When a libcurl-based application performs transfers via SCP:// or SFTP:// and utilizes the CURLOPTSSHKEYFUNCTION callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for th...

6AI score0.00325EPSS
SaveExploits1References3
CVE
CVE
added 2026/07/03 6:18 a.m.96 views

CVE-2026-9547

The CVE-2026-9547 issue affects libcurl when performing SCP/SFTP transfers with CURLOT_SSH_KEYFUNCTION in the SSH key callback. A host-key type mismatch for a known_hosts entry may be silently accepted, bypassing the intended validation and allowing connections to succeed without warning, which e...

7.4CVSS6AI score0.00325EPSS
SaveExploits1References3Affected Software1
AlpineLinux
AlpineLinux
added 2026/07/03 6:18 a.m.10 views

CVE-2026-9547

When a libcurl-based application performs transfers via SCP:// or SFTP:// and utilizes the CURLOPTSSHKEYFUNCTION callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for th...

7.4CVSS6AI score0.00325EPSS
SaveExploits1References3
OSV
OSV
added 2026/07/03 6:18 a.m.6 views

CVE-2026-9547 SSH improper host validation

When a libcurl-based application performs transfers via SCP:// or SFTP:// and utilizes the CURLOPTSSHKEYFUNCTION callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for th...

7.4CVSS6.1AI score0.00325EPSS
SaveExploits1References5
Cvelist
Cvelist
added 2026/07/03 6:17 a.m.54 views

CVE-2026-9080 UAF after pause in socket callback

Calling curleasypause within the event-based CURLMOPTSOCKETFUNCTION callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed...

0.00295EPSS
SaveExploits1References3
EUVD
EUVD
added 2026/07/03 6:17 a.m.15 views

EUVD-2026-41511

Calling curleasypause within the event-based CURLMOPTSOCKETFUNCTION callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed...

5.9AI score0.00295EPSS
SaveExploits1References3
CVE
CVE
added 2026/07/03 6:17 a.m.43 views

CVE-2026-9080

CVE-2026-9080 is a use-after-free in libcurl triggered when curl_easy_pause() is called from the event-based CURLMOPT_SOCKETFUNCTION callback. The underlying issue is a freed mev_sh_entry pointer being used to update tracing fields, potentially allowing DoS or code execution paths. Affected softw...

7.3CVSS5.9AI score0.00295EPSS
SaveExploits1References3Affected Software1
Vulnrichment
Vulnrichment
added 2026/07/03 6:17 a.m.6 views

CVE-2026-9080 UAF after pause in socket callback

Calling curleasypause within the event-based CURLMOPTSOCKETFUNCTION callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed...

5.9AI score0.00295EPSS
SaveExploits1References3
OSV
OSV
added 2026/07/03 6:17 a.m.10 views

CVE-2026-9080 UAF after pause in socket callback

Calling curleasypause within the event-based CURLMOPTSOCKETFUNCTION callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed...

7.3CVSS6AI score0.00295EPSS
SaveExploits1References5
Positive Technologies
Positive Technologies
added 2026/07/03 12:0 a.m.22 views

PT-2026-55655

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Improper authorization occurs during the OAuth sign-in callback process, which allows accounts that were previously disabled by an administrator to be silently...

9.8CVSS5.9AI score0.00339EPSS
SaveExploits0
NVD
NVD
added 2026/07/01 8:17 p.m.11 views

CVE-2026-58592

Ladybird contains a dangling-reference memory-safety flaw in its WebAssembly ESM-integration module loader. When a JavaScript function is imported into a WebAssembly module via the ESM path, WebAssemblyModule.cpp passes a stack-local Wasm::FunctionType by reference to createhostfunction, whose ho...

8.9CVSS0.00311EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/07/01 7:27 p.m.10 views

EUVD-2026-41130

Ladybird contains a dangling-reference memory-safety flaw in its WebAssembly ESM-integration module loader. When a JavaScript function is imported into a WebAssembly module via the ESM path, WebAssemblyModule.cpp passes a stack-local Wasm::FunctionType by reference to createhostfunction, whose ho...

8.9CVSS6.4AI score0.00311EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/07/01 7:27 p.m.47 views

CVE-2026-58592 Ladybird - Web-Reachable Code Execution via Dangling FunctionType Reference in WebAssembly ESM Integration

Ladybird contains a dangling-reference memory-safety flaw in its WebAssembly ESM-integration module loader. When a JavaScript function is imported into a WebAssembly module via the ESM path, WebAssemblyModule.cpp passes a stack-local Wasm::FunctionType by reference to createhostfunction, whose ho...

8.9CVSS0.00311EPSS
SaveExploits0References3
UbuntuCve
UbuntuCve
added 2026/07/01 4:16 p.m.8 views

CVE-2025-15646

HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion. Support for the element was added to libgumbo 0.10.0 in 2015, but the walktree function in lib/HTML/Gumbo.xs was not updated to support it. The element was treated as a text-node, where strlen over-reads the heap...

9.8CVSS6.1AI score0.00512EPSS
SaveExploits0References3
NVD
NVD
added 2026/07/01 7:16 a.m.11 views

CVE-2026-1239

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization check on the 'ninja-forms-views/token/refresh' REST callback in all versions up to, and including, 3.14.1. This makes it possible for...

7.5CVSS0.00298EPSS
SaveExploits0References2
SUSE CVE
SUSE CVE
added 2026/07/01 3:19 a.m.7 views

SUSE CVE-2026-53046

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine ksmbdcryptmessage sets a NULL completion callback on AEAD requests and does not handle the -EINPROGRESS return code from async hardware crypto engines like the...

9.8CVSS5.9AI score0.00524EPSS
SaveExploits0References4
SUSE CVE
SUSE CVE
added 2026/07/01 3:18 a.m.8 views

SUSE CVE-2026-53115

In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc: use generic driveroverride infrastructure When a driver is probed through driverattach, the bus' match callback is called without the device lock held, thus accessing the driveroverride field without a lock, which ca...

5.8AI score0.0012EPSS
SaveExploits0References3
NVD
NVD
added 2026/07/01 12:16 a.m.13 views

CVE-2026-54898

Oj Optimized JSON is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2,Oj::Parserparse is vulnerable to a heap use-after-free when a SAJ/SAJ2 callback mutates the input JSON string during parsing. The C engine holds a raw const byte pointer into the Ruby...

2.1CVSS0.00117EPSS
SaveExploits0References1
BDU FSTEC
BDU FSTEC
added 2026/07/01 12:0 a.m.7 views

The vulnerability of the gs_usb_receive_bulk_callback() function in the drivers/net/can/usb/gs_usb.c module of the Linux network device driver framework allows a attacker to gain access to protected information or cause a service failure.

The vulnerability of the gsusbreceivebulkcallback function in the drivers/net/can/usb/gsusb.c module of the Linux network device driver framework is related to reading beyond the buffer boundaries. Exploiting this vulnerability could allow an attacker to access protected information or cause...

6.1CVSS6.2AI score0.00162EPSS
SaveExploits0References12Affected Software4
OSV
OSV
added 2026/06/30 11:39 p.m.9 views

BIT-ENVOY-2026-47775 Envoy OAuth2 Filter: Padding Oracle via AES-256-CBC Cookie Decryption

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, the OAuth2 HTTP filter's encrypt/decrypt functions use AES-256-CBC without an authentication tag no HMAC, no AEAD. The /callback endpoint returns HTTP 302 on...

6.8CVSS5.8AI score0.00163EPSS
SaveExploits1References2
Rows per page
Query Builder