830102 matches found
CVE-2026-55246
The bincookie header-only binarycookies parser is vulnerable to a heap buffer overflow and out-of-bounds write in versions prior to 0.1.9 . The root cause lies in the bincookie_init_file() function within bincookie.h, which uses the file-controlled num_pages field as a loop bound for byte-swappin...
CVE-2026-55246 bincookie: Heap buffer overflow via unvalidated `num_pages` when parsing a `.binarycookies` file
bincookie is a header-only binarycookies parser. Prior to 0.1.9, bincookieinitfile in bincookie.h allocates a buffer using the actual .binarycookies file length but trusts the file-controlled numpages field as the loop bound for byte-swapping pagesizes entries. A crafted file can make the loop re...
CVE-2026-55246 bincookie: Heap buffer overflow via unvalidated `num_pages` when parsing a `.binarycookies` file
bincookie is a header-only binarycookies parser. Prior to 0.1.9, bincookieinitfile in bincookie.h allocates a buffer using the actual .binarycookies file length but trusts the file-controlled numpages field as the loop bound for byte-swapping pagesizes entries. A crafted file can make the loop re...
EUVD-2026-102202
Discourse ActivityPub adds ActivityPub support to Discourse. Prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5, inbound ActivityPub processing does not sufficiently verify that the actor authenticated by the signed request matches the Activity actor and owns the referenced federated post. ...
CVE-2026-55103
The Discourse ActivityPub component is vulnerable to insufficient verification of data authenticity and incorrect authorization. Specifically, inbound ActivityPub processing fails to verify that the authenticated actor matches the Activity actor and owns the referenced federated post. A remote at...
CVE-2026-55103 Discourse ActivityPub: Fix inbound actor validation and apply outbound request SSRF hardening
Discourse ActivityPub adds ActivityPub support to Discourse. Prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5, inbound ActivityPub processing does not sufficiently verify that the actor authenticated by the signed request matches the Activity actor and owns the referenced federated post. ...
CVE-2026-55103 Discourse ActivityPub: Fix inbound actor validation and apply outbound request SSRF hardening
Discourse ActivityPub adds ActivityPub support to Discourse. Prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5, inbound ActivityPub processing does not sufficiently verify that the actor authenticated by the signed request matches the Activity actor and owns the referenced federated post. ...
Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in Jackson Core
Summary IBM SPSS Modeler is affected by multiple vulnerabilities in Jackson Core. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-68494 DESCRIPTION: The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length...
CVE-2026-100409 OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths
OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cach...
CVE-2026-100409
The OpenNext Cloudflare adapter (versions 0.3.0 through 1.20.2 ) is vulnerable to an authorization bypass when enableCacheInterception is active. The root cause is an inconsistency in how encoded pathnames are processed between middleware matching and cache lookup. An unauthenticated attacker can...
CVE-2026-100409 OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths
OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cach...
EUVD-2026-102200
OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cach...
CVE-2026-100409 OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths
OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cach...
CVE-2026-102527 Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /og/d/.png route accepts unsigned requests while resolvePathCacheKey produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server...
EUVD-2026-102199
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /og/d/.png route accepts unsigned requests while resolvePathCacheKey produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server...
CVE-2026-102527
The Nuxt OG Image module is vulnerable to a cache poisoning attack in versions 6.2.5 through 6.7.0 . The root cause is that the dynamic /_og/d/*.png route accepts unsigned requests, and the resolvePathCacheKey() function generates cache keys from request paths and rendering options exposed via im...
CVE-2026-102527 Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /og/d/.png route accepts unsigned requests while resolvePathCacheKey produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server...
CVE-2026-102527 Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /og/d/.png route accepts unsigned requests while resolvePathCacheKey produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server...
