26879 matches found
CVE-2026-103659 MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attributes
MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the Object containment from the query and returns object attributes as top-level event attributes. In doing so, the object-level distributi...
CVE-2026-103659
MISP versions prior to 2.5.48 are vulnerable to an authorization bypass within the event flattening feature. When a user requests an event with the flatten option enabled, the application removes Object containment from the query and returns object attributes as top-level attributes without re-ap...
CVE-2026-103659 MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attributes
MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the Object containment from the query and returns object attributes as top-level event attributes. In doing so, the object-level distributi...
EUVD-2026-90575
MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the Object containment from the query and returns object attributes as top-level event attributes. In doing so, the object-level distributi...
CVE-2026-34189: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability allows unauthorized deletion of event responses via a forged GET request when an authenticated administrator visits a malicious page. This issue affects Pandora FMS: from 777 onwards...
AlmaLinux 9.2 [TuxCare] Security Update: wireshark / wireshark-cli / wireshark-devel Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1777370059)
The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1777370059 advisory. - Crash in the Sysdig Event dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafte...
CVE-2026-103659: Missing Authorization
MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the Object containment from the query and returns object attributes as top-level event attributes. In doing so, the object-level distributi...
CVE-2026-103261: Allocation of Resources Without Limits or Throttling
Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.init, allowing remote attackers to cause event-loop stalling by sending requests with thousands of query parameters. Attackers can send unauthenticated GET requests with unbounded query-string field counts ...
Tornado: Unbounded query-string argument count allows event-loop-stalling DoS
Summary HTTPServerRequest.init in tornado/httputil.py parses the URL query string via parseqsbytes with no field-count limit — while the sibling POST-body parsing path parsebodyarguments received a maxnumfields=1000 cap added earlier in this exact same release v6.5.8, commit 8d6363ed, explicitly ...
brace-expansion: brace-expansion: Denial of Service via crafted brace patterns
A flaw was found in brace-expansion. A remote attacker can cause a Denial of Service DoS by supplying specially crafted string patterns with repeated closing braces. Processing these malformed patterns causes the string expansion logic to repeatedly rescan the entire input, leading to excessive...
CVE-2024-42009
CVE-2024-42009 – Roundcube Stored XSS Docker PoC 📌 Обзор В этом репозитории представлена рабочая Proof-of-Concept PoC для CVE-2024-42009 — уязвимости хранимого межсайтового скриптинга XSS в Roundcube Webmail. Уязвимость вызвана некорректной санитизацией HTML с последующей небезопасной повторной...
CVE-2025-65354
CVE-2025-65354 — Уязвимость SQL-инъекции Краткое описание Уязвимость SQL-инъекции существует в приложении event-management версии 1.0 от PuneethReddyHC из-за некорректной обработки ввода. Тип уязвимости SQL-инъекция Поражённый компонент Конечная точка: /Grocery/searchproductsitname.php Параметр:...
CVE-2026-47598
NVIDIA GPU Display Driver for Linux contains a vulnerability in the open-source kernel module event delivery path where an unprivileged local user could cause a use-after-free through a race between asynchronous event delivery and file close. A successful exploit of this vulnerability might lead ...
SUSE CVE-2026-102277
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted a,b-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The...
SUSE CVE-2026-102414
pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than the block size 64 bytes, or 128 bytes for sha384 and sha512 is passed to HMAC as the key on every iteration, and HMAC hashes such keys in...
CVE-2026-97287
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Blind SQL Injection.This issue affects Event Tickets: from n/a through 5.29.5...
CVE-2026-103321
MISP contains a stored cross-site script XSS vulnerability in the event graph preview feature. The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered into an HTML img element's src attribute via string...
CVE-2026-97287 WordPress Event Tickets plugin <= 5.29.5 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Blind SQL Injection.This issue affects Event Tickets: from n/a through 5.29.5...