484737 matches found
EUVD-2026-101161
Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Insertion of Sensitive Information into Log File vulnerability in the provider configuration component. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information...
CVE-2026-91883
Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Insertion of Sensitive Information into Log File vulnerability in the provider configuration component. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information...
CVE-2026-59774
Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files...
CVE-2026-110637
buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows attackers to execute commands by supplying a crafted EPUB file name passed to kindlegen via childprocess.exec. Attackers can craft a book project with a malicious front-matter filename or project...
AZL-108384 CVE-2026-110258 affecting package javapackages-bootstrap 1.14.0-4
OW2 ASM 3.0 before 9.11 contains an excessive memory allocation vulnerability in Label.addSubroutineRetSuccessors that fails to enforce the single-RET-per-JSR rule. Attackers can supply a crafted invalid class file with multiple RET instructions for one JSR, triggering a roughly 2 GB allocation...
CVE-2024-58392
A flaw was found in PhysicsFS. An attacker could cause a Denial of Service DoS by supplying a specially crafted archive file. Due to an out-of-bounds read flaw when decoding multi-byte UTF-8 character sequences in entry names, the library advances past the end of the input buffer during string...
CVE-2026-110602
A flaw was found in libmspack. An attacker could exploit this vulnerability by enticing a user or application to process a specially crafted KWAJ compressed file containing invalid or truncated headers. When handling these errors, the library attempts to release uninitialized memory pointers,...
CVE-2026-110717 Janus WebRTC Server through 1.4.3 Path Traversal via Record&Play Filename
Janus WebRTC Server through 1.4.3 contains a path traversal vulnerability in the Record&Play plugin that allows unauthenticated attackers to write files outside recordingspath via the record request filename. Attackers can supply filenames with path separators to create or truncate files ending i...
CVE-2026-110717 Janus WebRTC Server through 1.4.3 Path Traversal via Record&Play Filename
Janus WebRTC Server through 1.4.3 contains a path traversal vulnerability in the Record&Play plugin that allows unauthenticated attackers to write files outside recordingspath via the record request filename. Attackers can supply filenames with path separators to create or truncate files ending i...
Use-after-free when using asynchronous file I/O (AIO)
Use-after-free when using asynchronous file I/O AIO Severity: medium CVE-2026-97205 Not vulnerable: 1.31.7+, 1.30.6+ Vulnerable: 0.8.11-1.31.6...
Security Bulletin: IBM i is Affected By Improper Authorization and Access Control Vulnerabilities in Network File System [CVE-2026-17068, CVE-2026-17073]
Summary IBM i is vulnerable to bypassing Network File System NFS version restrictions due to improper enforcement CVE-2026-17068 and obtaining sensitive information due to missing subtree checks CVE-2026-17073 in NFS as described in the vulnerability details section. Vulnerability Details...
CVE-2026-59774
Gitea versions 1.22.1 through 1.27.0 are vulnerable to an unauthenticated arbitrary file read flaw. The issue exists because the Org-mode markup renderer fails to override the default ReadFile callback in the go-org library. An attacker can submit Org-mode markup containing an #+INCLUDE directive...
CVE-2026-59774 Gitea Org-mode file disclosure and code execution
Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files...
EUVD-2026-101281
Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files...
CVE-2026-59774 Gitea Org-mode file disclosure and code execution
Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files...
CVE-2026-59774
Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files...
CVE-2026-59774 Gitea Org-mode file disclosure and code execution
Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files...
CVE-2026-110649
Versions of Stills before 25.24.2 are vulnerable to an OS command injection flaw. The vulnerability occurs when the application processes crafted media file paths containing $(...) or backticks. This allows an attacker to execute arbitrary shell commands with Node.js process privileges during the...
CVE-2026-110649 Stills before 25.24.2 OS Command Injection via Media File Names
Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. Attackers can name a media file with $... or backticks to execute operating system commands with Node.js process privileges when ffmpeg,...
CVE-2026-110642 xhtml2pdf before 0.2.19 OS Command Injection via startViewer File Name
xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS...