httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server

A flaw was found in Apache HTTP Server. This buffer over-read vulnerability occurs when the server processes outbound Online Certificate Status Protocol OCSP requests directed to an attacker-controlled OCSP server. This could allow a remote attacker to read sensitive information from memory or...

BIT-KIBANA-2026-63259 Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data from Kibana Spaces the requester is not authorized to access...

BIT-KIBANA-2026-56147 Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Information Disclosure and Case Attachment Integrity Compromise

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse CAPEC-122. An inconsistency in Kibana's file access authorization logic allows a low-privileged authenticated user to...

BIT-ELK-2026-63259 Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data from Kibana Spaces the requester is not authorized to access...

Exploit for CVE-2026-61511

cve-id Donate Support the maintenance of this project wit...

PT-2026-65609

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.17.0 through 0.60.1 Description Code injection is possible when generating Python models from attacker-controlled JSON Schema, OpenAPI, YAML, JSON, Avro, Protobuf, or XSD schemas. The issue occurs because th...

PT-2026-65473

The logic to handle periodic Viridian STIMERs performs a division with an unchecked user-controlled divisor value, that can be set to zero to cause a DE fault...

PT-2026-65561

pglogical's apply worker does not sufficiently validate the length of certain fields in incoming replication protocol messages before copying them, resulting in an out-of-bounds read. A party acting as the publisher for a subscription, for example a non-PostgreSQL endpoint that speaks the pglogic...

CVE-2026-54545: Improper Limitation of a Pathname to a Restricted Directory

wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlled module filenames only once before writing extracted modules, so a crafted filename containing overlapping traversal sequences such as ....// collapses to ../ after sanitizatio...

PT-2026-65467

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them:...

PT-2026-65617

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.11.6 through 0.63.0 Description A flaw in the handling of schema extensions allows for remote code execution on the machine that imports the generated model. When processing a malicious OpenAPI or JSON Schem...

PT-2026-65486

Pivotick did not validate the URL scheme of node imagePath values derived from graph data before assigning them to SVG image resources. An attacker able to supply crafted graph data could set an image path to a malicious URI. When a victim rendered the affected graph, the browser could resolve th...

PT-2026-65466

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them:...

CVE-2026-66824

CVE-2026-66824 is a stored XSS vulnerability in the capture tree visualization page. The app embeds the serialized capture tree directly into an inline JavaScript block via the Jinja safe filter. Attackers can craft values from captured content that terminate the [removed] tag and inject arbitrar...

CVE-2026-64645 Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a rewrites or redirects rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the...

CVE-2026-64645 Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a rewrites or redirects rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the...

CVE-2026-64645 Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a rewrites or redirects rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the...

CVE-2026-64645

The CVE-2026-64645 issue affects Next.js versions 12.0.0–15.5.20 and 16.0.0–16.2.10, where a rewrites() or redirects() rule may build the external destination hostname from request-controlled input. This allows an attacker to proxy a request to an arbitrary host (SSRF) or redirect users to an uni...

GO-2026-5046 CPU exhaustion in Avro decoder in github.com/iskorotkov/avro/v2 and github.com/hamba/avro/v2

The Avro array and map decoders loop over an attacker-controlled block-count value without checking the underlying reader's error state inside the loop body. Reader.ReadBlockHeader returns the count as a Go int, which is 64-bit on amd64 and arm64 targets. A producer can declare a block of up to...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the tickets.getMilestone process. An attacker can retrieve sensitive milestone data from projects they are not assigned to by supplying arbitrary integer milestone IDs through the...