354282 matches found
SUSE CVE-2026-102300
Uninitialized resource in WebGPU in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...
SUSE CVE-2026-102303
Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...
SUSE CVE-2026-102325
Uninitialized resource in Skia in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...
Improper Certificate Validation
Snowflake drivers are vulnerable to Improper Certificate Validation. The vulnerability is due to improper validation of OCSP responses and treating definitive verification failures as transient, which allows a man-in-the-middle attacker with a revoked certificate and its private key to establish ...
rubygem-mongo: MongoDB Ruby Driver: Data disclosure and denial of service via query-operator injection
A flaw was found in the GridFS component of the MongoDB Ruby Driver. Improper neutralization of special elements in data query logic can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than a literal identifier. An authenticated user who can...
Important: Red Hat Security Advisory: ruby:2.5 security update
An update for the ruby:2.5 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
A race condition was found in the Linux kernel cryptographic user API, AFALG in the way concurrent writes to the same AFALG socket are handled. Interleaved data and inconsistent internal socket state may result. A local user could use this flaw to crash the system or corrupt cryptographic operati...
CVE-2025-39247
CVE-2025-39247 標的: HikCentral Professional（HCMP、中央VMSサーバー） CVE: CVE-2025-39247 — アクセス制御の脆弱性 CVSS 3.1: 8.6（AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N） 影響を受けるバージョン: V2.3.1 – V2.6.2 および V3.0.0 修正済み: V2.6.3 / V3.0.1 / Fix-Pack CVE-2025-39247 公開日: 2025-08-28 分析日: 2026-05-21 1. オープンソースインテリジェンス調査...
Malicious code in friendly-greeting-tools (PyPI)
Versions 0.1.0 through 0.3.6 of friendly-greeting-tools disguise encoded Snowflake credential and data theft routines as a hello-world demo. In versions through 0.3.5, the default rundemo payload reads the Snowflake session token, connection configuration, dbt profiles, and pip configuration, the...
MAL-2026-17416 Malicious code in friendly-greeting-tools (PyPI)
Versions 0.1.0 through 0.3.6 of friendly-greeting-tools disguise encoded Snowflake credential and data theft routines as a hello-world demo. In versions through 0.3.5, the default rundemo payload reads the Snowflake session token, connection configuration, dbt profiles, and pip configuration, the...
CVE-2024-10220-demo
此存储库没有 README。...
CVE-2026-103388 MISP Stored Cross-Site Scripting via JavaScript URL in Galaxy Cluster Source Field
MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP's FILTERVALIDATEURL validation. Because FILTERVALIDATEURL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local instance or on a synced instance could...
Cross-site Scripting (XSS)
Apache Wicket is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper escaping of attacker-influenced model data rendered inside elements, which allows an attacker to inject and execute malicious HTML or script content in a victim's browser...
CVE-2026-103044
A flaw was found in the MediaWiki EasyTimeline extension. An Extensible Markup Language XML injection vulnerability exists due to improperly serving image map files as XML data. A remote attacker could exploit this flaw by convincing a user to interact with specially crafted content, potentially...
netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion
A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker could exploit this vulnerability by sending a specific sequence of HTTP responses 103, followed by a 200 with a GET body, then another 200 for a HEAD request when the client pipelines GET the...
Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.16 security update
A security update is now available for Red Hat JBoss Enterprise Application Platform 7.1 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...
CVE-2026-97302
Unauthenticated Sensitive Data Exposure in MPG = 4.2.3 versions...
CVE-2026-97261
Unauthenticated Sensitive Data Exposure in Notivo = 1.4.2 versions...