110566 matches found
CVE-2026-13078
A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit...
EUVD-2026-47783
A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit...
CVE-2026-13078
A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit...
CVE-2026-13078 Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader
A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit...
CVE-2026-13078 Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader
A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit...
CVE-2026-16157
Duplicati v2.3.0.1 backup software gives Authenticated Users MODIFY permissions that propagate to all subdirectories. Installing the software outside of the Program Files directory, or on a custom path, creates a LocalSystem service running from a directory that any standard local user can write...
EUVD-2026-47760
FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. Whe...
CVE-2026-64835 FFmpeg 4.4 - 8.1.2 Out-of-Bounds Memory Access in ADX Audio Decoder
FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. Whe...
USN-8590-1 exim4 vulnerabilities
It was discovered that Exim incorrectly handled certain command line options. A local attacker could possibly use this issue to access files outside of the spool area. It was discovered that Exim incorrectly handled string expansion in .local files. A local attacker could possibly use this issue ...
USN-8590-1: Exim vulnerabilities
It was discovered that Exim incorrectly handled certain command line options. A local attacker could possibly use this issue to access files outside of the spool area. It was discovered that Exim incorrectly handled string expansion in .local files. A local attacker could possibly use this issue ...
CVE-2026-64830 FFmpeg 2.1 - 8.1.2 Heap Buffer Overflow via VobSub Subtitle Demuxer
FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in...
USN-8477-3: tar regression
USN-8477-1 fixed a vulnerability in tar. That fix was incomplete and could cause tar to fail to extract old archives that recorded a nonzero size for directory entries, resulting in a regression. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was...
CVE-2026-55990
In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the 'dnscrypt:' clause lists more 'dnscrypt-provider-cert:' files than there are matching 'dnscrypt-secret-key:' files, Unbound fills only the matched prefix and leaves the tail slots at the '0xdb' fill that libsodium's allocator writes...
CVE-2026-14932
In Progress® Telerik® UI for AJAX prior to v2026.2.708, the obsolete RadChart component's ChartImage.axd handler is vulnerable to unauthenticated file read and deletion of image-extension files within the application directory...
unbound: Unbound: Insecure DNS redirection via spoofed DNS answers
A flaw in Unbound's respip module fails to verify the security status of incoming DNS answers when using response-ip rules or RPZ files. A remote attacker can exploit this by spoofing DNS answers to bypass DNSSEC protections and trigger unauthorized rewrites, redirecting clients to unintended...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal in the ServeHTTP function in pkg/middlewares/replacepathregex/replacepathregex.go, which forwards the post-substitution path to the backend without checking whether it normalizes to a different route. An attacker can...
EUVD-2026-47699
In Progress® Telerik® UI for AJAX prior to v2026.2.708, the obsolete RadChart component's ChartImage.axd handler is vulnerable to unauthenticated file read and deletion of image-extension files within the application directory...
CVE-2026-14932 Unauthenticated File Read and Deletion via Hardcoded Encryption Key in RadChart
In Progress® Telerik® UI for AJAX prior to v2026.2.708, the obsolete RadChart component's ChartImage.axd handler is vulnerable to unauthenticated file read and deletion of image-extension files within the application directory...
USN-8584-1: GStreamer Good Plugins vulnerabilities
It was discovered that GStreamer Good Plugins incorrectly handled certain Matroska files. An attacker could possibly use this issue to cause GStreamer Good Plugins to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. CVE-2026-39043 It was...
USN-8583-1: GIFLIB vulnerabilities
It was discovered that GIFLIB incorrectly handled certain GIF image files. If a user or automated system were tricked into opening a specially crafted GIF file, a remote attacker could use this issue to cause GIFLIB to crash, resulting in a denial of service, or possibly execute arbitrary code...