55115 matches found
MAL-2026-10644 Malicious code in proxy-checker-j (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4316f8f54acc92939cdf73074666eecab7d5e680c7c4ad572ad3164671aa19dc The package is published on PyPI as proxy-checker-j with the summary 'packaged command for running the bundled qsshd executable', but its actual...
CVE-2026-48125
UAParser.js (versions 2.0.1–2.0.9) is affected by a Regular Expression Denial of Service (ReDoS) when using the Client Hints API. A crafted Sec-CH-UA-Model header passed to UAParser(headers).withClientHints() can cause catastrophic backtracking in the device regex, leading to excessive CPU usage ...
CVE-2026-48125 UAParser.js: Unbounded `Sec-CH-UA-Model` parsing can trigger ReDoS in `withClientHints()`
UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data. From 2.0.1 until 2.0.10, a regular expression denial-of-service vulnerability exists when using the Client Hints API. By sending a crafted Sec-CH-UA-Model header to an application th...
libinput: local privilege escalation via crafted uinput devices
A flaw was found in libinput. A local attacker with access to /dev/uinput can inject arbitrary udev properties through the libinput-device-group helper. This injection can lead to root code execution, for example, by exploiting REMOVECMD properties that are executed when a device is removed. This...
CVE-2026-5040
TP-Link Deco M5 v1 uses a weak password hashing mechanism to store user credentials. An attacker who obtains the password hash through system compromise or privileged access could perform brute-force or dictionary attacks. Successful exploitation may result in disclosure of authentication...
CVE-2026-62655
A security flaw was found in certain NETGEAR Orbi models that could allow an unauthorized user to cause the device to stop responding or restart unexpectedly, disrupting network connectivity and making the device temporarily unavailable...
CVE-2026-50387
Stack-based buffer overflow in Windows GDI allows an authorized attacker to elevate privileges locally...
CVE-2026-5040
TP-Link Deco M5 v1 uses a weak password hashing mechanism to store user credentials. An attacker who obtains the password hash through system compromise or privileged access could perform brute-force or dictionary attacks. Successful exploitation may result in disclosure of authentication...
CVE-2026-5040 Weak Password Hashing Mechanism in TP-Link Deco M5
TP-Link Deco M5 v1 uses a weak password hashing mechanism to store user credentials. An attacker who obtains the password hash through system compromise or privileged access could perform brute-force or dictionary attacks. Successful exploitation may result in disclosure of authentication...
CVE-2026-5040
The CVE-2026-5040 entry applies to TP-Link Deco M5 v1. The issue stems from a weak password hashing mechanism used to store user credentials. An attacker who obtains the password hash via system compromise or privileged access could perform brute-force or dictionary attacks. Practical consequence...
CVE-2026-62659 Authenticated users can make unauthorized changes on NETGEAR WAX333 Access Points
A security flaw was discovered in the NETGEAR WAX333 Access Point that could allow someone already logged in and connected to the local network to make unauthorized changes to the device's settings...
CVE-2026-58547 Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability
...
CVE-2026-58547
CVE-2026-58547 is a Windows UPnP Device Host vulnerability. The issue is a heap-based buffer overflow in upnp.dll that allows an authenticated local attacker to elevate privileges. The NVD entry and multiple advisories describe the root cause as a heap overflow in UPnP device host, with CVSS deta...
CVE-2026-58547 Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability
...
CVE-2026-50387 Windows GDI Elevation of Privilege Vulnerability
...
CVE-2026-50387 Windows GDI Elevation of Privilege Vulnerability
...
CVE-2026-50310 Windows Human Interface Device Information Disclosure Vulnerability
...
CVE-2026-50310 Windows Human Interface Device Information Disclosure Vulnerability
...
CVE-2026-50310
CVE-2026-50310 describes an integer overflow/wraparound in Windows Devices Human Interface which allows an authorized local attacker to disclose information. Affected component is the Windows Devices Human Interface; root cause is an overflow condition that can leak data locally. Microsoft has re...