850631 matches found
PT-2026-122142
Cacti is an open source performance and fault management framework. Prior to version 1.2.31, a User Enumeration vulnerability allows an attacker to identify valid usernames on the Cacti service. When a user attempts to log in, the application returns slightly different error messages depending on...
PT-2026-122443
Summary installBazaarPlugin and the equivalent endpoints for widgets/icons/templates/themes accept packageName, repoURL, and repoHash as independent request fields with no validation that they refer to the same package. packageName alone determines the install destination; repoURL/repoHash alone...
CVE-2026-80353
Time-of-check time-of-use TOCTOU race condition vulnerability in Apa...
PT-2026-122221
Name of the Vulnerable Software and Affected Versions Twisted versions prior to 26.10.0rc1 Description An unauthenticated remote peer can cause memory exhaustion leading to a denial of service. The issue occurs in the twisted.conch.telnet.Telnet.dataReceived function, which appends bytes received...
PT-2026-122224
Name of the Vulnerable Software and Affected Versions Twisted versions prior to 26.10.0rc1 Description An incomplete header-value validation in the Twisted HTTP server allows a bare carriage return CR or line feed LF in a header value to hide a subsequent header from the parser. The function...
PT-2026-122239
Name of the Vulnerable Software and Affected Versions happy-dom versions 17.0.0 through 21.0.3 Description The ESM compiler in packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts fails to validate named ESM import aliases before inserting them into generated destructuring bindings. When...
CVE-2026-114138
Django REST framework is a toolkit for building Web APIs. Prior to 3.1...
PT-2026-122135
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.08 to before version 26.05, the IIIF Auth 2.0 endpoints auth/login and auth/token in AuthorizationFlowResource accept an origin query parameter without validation and then 1 embe...
CVE-2026-105959
A flaw was found in spice-server. The GLZ encoder dictionary restore p...
PT-2026-122155
Tokio is a runtime for writing applications with Rust. In 1.54.0, a race condition between tokio::time::Interval::poll tick including .tick.await and the multi-threaded runtime's time driver could drop an internal timer entry without synchronizing with the driver thread that was firing it. The ra...
PT-2026-122419
Summary On the multi-threaded runtime, there is a race condition between Interval::poll tick and the runtime's time driver. This affects Interval only. Sleep and Timeout are not affected. Details In Tokio v1.54.0, a race condition between tokio::time::Interval::poll tick including .tick.await and...
PT-2026-122459
On Windows, ReadWriteLock and AsyncReadWriteLock the SQLite-backed reader/writer lock connect SQLite to the lock database by its path, in every directory. SQLite derives three side files from that path: -journal, the rollback journal pages saved to undo an interrupted write; -wal, the write-ahead...
PT-2026-122447
Impact Origin validation error in Microsoft Authentication Library MSAL for Node.js allows an unauthorized attacker to disclose information over a network. This affects the auth code flow. Patches Version 7.1.0 and higher are patched. Workarounds Ensure you pass in only the auth code to to...
PT-2026-122220
Name of the Vulnerable Software and Affected Versions Twisted versions prior to 26.10.0rc1 Description An unbounded-buffer issue exists in the Twisted words IRC server where the dataReceived function in twisted.words.protocols.irc.IRC appends all received bytes to a per-connection buffer without...
PT-2026-122218
Name of the Vulnerable Software and Affected Versions Twisted versions prior to 26.10.0rc1 Description An issue exists in the twisted.mail.imap4.IMAP4Server where the twisted.mail.imap4.parseNestedParens function can be reached with a negative literal size during an authenticated SEARCH command...
PT-2026-122219
Name of the Vulnerable Software and Affected Versions Twisted versions prior to 26.10.0rc1 Description The twisted.words.xish.domish ExpatElementStream parser allows an unauthenticated remote peer to keep a container element open while continuously adding child elements. Because the parser retain...
UBUNTU-CVE-2026-105959
A flaw was found in spice-server. The GLZ encoder dictionary restore p...
UBUNTU-CVE-2026-80353
Time-of-check time-of-use TOCTOU race condition vulnerability in Apa...