6114 matches found
jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution
A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the system to process untrusted data, which may lead to the...
PT-2026-71293
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 Reverse Proxy in certain configurations may provide weaker than expected cryptographic validation of user supplied data...
SUSE CVE-2026-68340
In the Linux kernel, the following vulnerability has been resolved: hwmon: occ: validate poll response sensor blocks The OCC poll response parser walks a counted list of sensor data blocks. It used the static backing-array capacity as the parse boundary, but a transport response makes only...
CVE-2026-18694
An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileges to cause certain malformed geometry data to be stored and later processed without proper validation. Subsequent queries against this data could then result in the server accessing memo...
UBUNTU-CVE-2026-18700
An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed, through concurrent operations against a collection using a certain type of validator. This could result ...
CVE-2026-16985
The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its attachment-update actions, allowing users with the uploadfiles capability Author and above to write an executable PHP file into the uploads directory and achiev...
EulerOS 2.0 SP11 : glibc (EulerOS-SA-2026-3121)
According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Calling the scanf family of functions with a %mc malloc'd character match in the GNU C Library version 2.7 to version 2.43 with a format width...
CVE-2026-62295
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the JSON utility parser in org.hl7.fhir.utilities.json.parser.JsonParser enforces no maximum nesting depth for arrays or objects. As a result, a small but deeply nested,...
The vulnerability of Cisco IOS XE operating systems, related to insufficient validation of input data, allows attackers to compromise the accessibility of protected information.
The vulnerability of Cisco IOS XE operating systems is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to compromise the accessibility of protected information...
The vulnerability of the Input component in Google Chrome and Microsoft Edge web browsers allows attackers to access confidential data.
The vulnerability of the Input component in the Google Chrome web browser is related to insufficient validation of entered data. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...
CVE-2026-70598
CVE-2026-70598 affects Electron: prior to 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3, offscreen rendering frame data from the GPU process was not fully validated by the main process. A compromised GPU process could cause the main process to read out‑of‑bounds memory while producing paint images, ...
CVE-2026-15920
A flaw was found in Django. The django.contrib.admin.utils.displayforfield function renders URLField values as clickable links in the administrative interface without proper validation. If an application persists URLField data containing an unsafe scheme without running model validation, a remote...
Cross-site Scripting (XSS)
Overview Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the displayforfield function. An attacker can execute arbitrary JavaScript code in the context of th...
The vulnerability of software products for conducting Zoom Workplace video conferences on the Windows operating system, related to insufficient input data validation, allows a perpetrator to compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerability of software products for conducting Zoom Workplace video conferences on the Windows operating system is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to compromise the confidentiality, integrity, and accessibility of...
Exposure of Sensitive Information Through Metadata
Overview Affected versions of this package are vulnerable to Exposure of Sensitive Information Through Metadata via CFB quick-check decryption oracle in the getDataStream method of PGPSymmetricKeyEncryptedData, reached through PGPPBEEncryptedData, PGPSessionKeyEncryptedData, and...
Chromium: CVE-2026-15131 Insufficient data validation in Navigation
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium: CVE-2026-15123 Insufficient data validation in DOM
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
CVE-2026-13871
An insufficient data validation flaw was found in the GuestView component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=497961376...