93627 matches found
CVE-2026-105241 Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batch
Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net. Content that the mail file writer cannot encode, such as an unpaired UTF-16 surrogate, made the write throw. Every buffered event in the batch was discarded, not only the one carrying the content,...
CVE-2026-106450
yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader allocates two new 4 MiB block buffers whenever a maximum-block-size frame header is read, and the default concatenated-frame mode allows attacker-controlled streams containing many...
CVE-2026-106449
yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill, allowing a long sequence of empty blocks in an attacker-controlled compresse...
CVE-2026-106447 StableLib: Stack exhaustion denial of service via deeply nested CBOR arrays, maps, or tags
StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor decoder recursively processes nested CBOR arrays, maps, and tags through decodeValue without enforcing a maximum nesting depth. A sufficiently deep structure exhausts the JavaScript call...
EUVD-2026-93971
StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor decoder recursively processes nested CBOR arrays, maps, and tags through decodeValue without enforcing a maximum nesting depth. A sufficiently deep structure exhausts the JavaScript call...
CVE-2026-106447
The @stablelib/cbor decoder in StableLib (prior to version 2.0.4 ) is vulnerable to a stack exhaustion denial of service . The root cause is that the _decodeValue() function recursively processes nested CBOR arrays, maps, and tags without enforcing a maximum nesting depth. An attacker providing a...
CVE-2026-94114 Apache Commons BCEL: Class repositories cache class files under their self-declared names, enabling cache poisoning
Symbolic name not mapping to correct class. BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class. This issue affects Apache Commons BCEL: before...
CVE-2026-94114 Apache Commons BCEL: Class repositories cache class files under their self-declared names, enabling cache poisoning
Symbolic name not mapping to correct class. BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class. This issue affects Apache Commons BCEL: before...
CVE-2026-94114
Apache Commons BCEL versions before 6.13.0 are vulnerable to a symbolic name mapping issue. The BCEL component caches attacker-controlled classes using self-declared names without sufficient validation. This flaw allows subsequent lookups and name-keyed verification results to point to different ...
CVE-2026-102167
A memory corruption vulnerability exists in the wired uplink network endpoints of affected Arista Wi-Fi access points . This flaw, categorized as a stack-based buffer overflow (CWE-121), allows an unauthenticated attacker positioned on the same network segment as the wired uplink to crash the sen...
CVE-2026-102167 Security Advisory 0197
On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints. An unauthenticated attacker can crash the sensor service or potentially achieve remote code execution. Exploitation requires the attacker to be on the same network...
EUVD-2026-93967
On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints. An unauthenticated attacker can crash the sensor service or potentially achieve remote code execution. Exploitation requires the attacker to be on the same network...
EUVD-2026-93965
On affected Arista access points with Wireless Intrusion Prevention System WIPS active, an unauthenticated attacker within radio frequency RF proximity can send a crafted frame to crash the sensor service, disabling WIPS monitoring on the access point, or potentially achieve remote code execution...
CVE-2026-102163 Security Advisory 0195
On affected Arista access points with Wireless Intrusion Prevention System WIPS active, an unauthenticated attacker within radio frequency RF proximity can send a crafted frame to crash the sensor service, disabling WIPS monitoring on the access point, or potentially achieve remote code execution...
CVE-2026-102163 Security Advisory 0195
On affected Arista access points with Wireless Intrusion Prevention System WIPS active, an unauthenticated attacker within radio frequency RF proximity can send a crafted frame to crash the sensor service, disabling WIPS monitoring on the access point, or potentially achieve remote code execution...
CVE-2026-102169 Security Advisory 0194
On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a captive-portal-enabled SSID can crash the portal service with a crafted HTTP request. The service automatically restarts, but a sustained low-rate attack can cause a persistent...
CVE-2026-102168
Affected Arista Wi-Fi access points with Captive Portal enabled are vulnerable to a service crash. An unauthenticated wireless client connected to a Captive-Portal-enabled SSID can send a crafted HTTP request to crash the portal service. This vulnerability, caused by an Integer Underflow (CWE-191...
CVE-2026-102169
Affected Arista Wi-Fi access points with Captive Portal enabled are vulnerable to a denial of service (DoS) condition. An unauthenticated wireless client can crash the portal service by sending a crafted HTTP request to a captive-portal-enabled SSID. While the service automatically restarts, a su...
EUVD-2026-93963
On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a Captive-Portal-enabled SSID can crash the portal service with a crafted HTTP request. This results in a temporary denial of service until the service automatically restarts. Remot...
CVE-2026-102168 Security Advisory 0194
On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a Captive-Portal-enabled SSID can crash the portal service with a crafted HTTP request. This results in a temporary denial of service until the service automatically restarts. Remot...