CVE-2026-50538

LibVNCClient is a library for easy implementation of a VNC client. In versions 0.9.12 through 0.9.15, a malicious or man-in-the-middle VNC server can force a connecting libvncclient to write attacker-controlled data past the end of its framebuffer. This is an out-of-bounds heap write with...

CVE-2026-45271

Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. Picotls implements its own ASN.1 validation helper, which is used by the minicrypto backend while parsing local PKCS8 private keys. Prior to commit c14231d801407640bc42c2dcf92783409ea6a7c...

EUVD-2026-64151

kin-openapi is a Go project for handling OpenAPI files. From 0.124.0 until 0.142.0, openapi3filter.sliceMapToSlice in openapi3filter/reqrespdecoder.go converts attacker-controlled sparse indexes from a deepObject query parameter into a dense slice by allocating entries from zero through the large...

CVE-2026-76905

kin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.convertParseError in openapi3filter/validationerrorencoder.go dereferences e.Parameter.In without checking whether e.Parameter is nil. A malformed non-string scalar field in a multipart/form-data...

EUVD-2026-64150

kin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.convertParseError in openapi3filter/validationerrorencoder.go dereferences e.Parameter.In without checking whether e.Parameter is nil. A malformed non-string scalar field in a multipart/form-data...

EUVD-2026-64142

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From 0.19.8 until 0.45.0, Atlantis does not consistently validate user-controlled workspace values supplied through accepted repository-level atlantis.yaml configuration or authenticated...

EUVD-2026-64134

Keystone is a content management system for Node.js. Prior to 6.5.3, the findMany resolver in packages/core/src/lib/core/queries/resolvers.ts compares the signed take argument directly with graphql.maxTake, allowing a remote unauthenticated GraphQL client to provide a negative take value whose...

CVE-2026-63462

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErrorMessage and fromOpenApiValidationErrors without guarding...

NPM: Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter

NPM: Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter vulnerability discovered by ? in WordPress Npm unleash-server versions 7.5.2...

CVE-2026-63462

Unleash , an open-source feature management platform, is vulnerable to an unauthenticated denial-of-service in versions prior to 7.5.2, 7.6.5, and 8.0.2 . The root cause is in the shared OpenAPI validation error path (src/lib/error/bad-data-error.ts), which passes a raw request value from lodash....

CVE-2026-63462 Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErrorMessage and fromOpenApiValidationErrors without guarding...

EUVD-2026-64041

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErrorMessage and fromOpenApiValidationErrors without guarding...

CVE-2026-70656

Checkmate (open-source self-hosted server monitoring tool) versions 3.5.1 through 3.9.2 are vulnerable to ReDoS (Regular Expression Denial of Service). An authenticated admin or superadmin can set matchMethod to regex and inject a malicious expression into the expectedValue field for advanced HTT...

CVE-2026-55241

Checkmate , an open-source self-hosted server monitoring tool, is vulnerable to a pre-authentication denial of service in versions prior to 3.9.1 . The public POST /api/v1/auth/register endpoint processes multipart profileImage uploads through in-memory Multer parsing before registration or invit...

EUVD-2026-64037

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. Prior to 3.9.1, the public POST /api/v1/auth/register route in server/src/api/routes/authRoutes.ts passes multipart...

CVE-2026-59274

CVE-2026-59274...

CVE-2026-47891

CVE-2026-47891...

CVE-2026-17252 Unauthenticated Denial of Service via Composed HTTP Parsing and Stack-Based Out-of-Bounds Write Vulnerability in TL-MR6400 Web Management Interface

A stack-based out-of-bounds write vulnerability exists in the login request handling functionality of the administrative web interface of TP-Link TL-MR6400 v7 routers. An unauthenticated adjacent attacker can trigger the vulnerability by sending a specially crafted malformed HTTP request...

EUVD-2026-64008

A stack-based out-of-bounds write vulnerability exists in the login request handling functionality of the administrative web interface of TP-Link TL-MR6400 v7 routers. An unauthenticated adjacent attacker can trigger the vulnerability by sending a specially crafted malformed HTTP request...

CVE-2026-17252

A stack-based out-of-bounds write vulnerability exists in the login request handling of the administrative web interface on TP-Link TL-MR6400 v7 routers. An unauthenticated adjacent attacker can trigger the flaw by sending a specially crafted malformed HTTP request, causing the web service proces...