132728 matches found
CVE-2026-64558
In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in pkeypckmo handler implementation Explicitly check the length of the target buffer in the pkeypckmo implementation of the keytoprotkey handler function. The handler function fails, if the generated outpu...
EUVD-2026-43705
Easy!Appointments disablebookingmessage rendered as raw HTML on public booking page — Stored XSS...
CVE-2026-54078
veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity XXE vulnerability in validation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java in...
CVE-2026-54663
swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts warmUpRemoteSchemasCache resolves external $ref URLs and fetchRemoteSchemaDocument uses isHttpUrl to fetch any http or https target without private IP,...
CVE-2026-54661
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers0.url from src/code-gen-process.ts into the HttpClient constructor without escaping, allowing an attacker-controll...
CVE-2026-54664
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-parser/base-schema-parsers/enum.ts passes components.schemas..enumi values to Ts.StringValue in src/configuration.ts without escaping before...
CVE-2026-54082 veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs
veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity vulnerability in PDFAValidator.validate... and GFPDAcroForm.getdynamicRender, where default DocumentBuilderFactory parsing of...
CVE-2026-54661
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers0.url from src/code-gen-process.ts into the HttpClient constructor without escaping, allowing an attacker-controll...
CVE-2026-54662 swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template
swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers0.url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-client.ejs interpolates apiConfig.baseUrl into the generate...
CVE-2026-54660 swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`
swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts getRemoteRequestHeaders forwards --authorizationToken to every URL fetched by fetchRemoteSchemaDocument while warmUpRemoteSchemasCache resolves external $r...
CVE-2026-66723 Missing authentication requirement in Remote Instances proxy API in MWDB Core
MWDB Core versions =2.2.0 and 2.19.0 contain a missing authorization vulnerability in the Remote Instances proxy API. The proxy API does not verify authentication for incoming requests, allowing an unauthenticated remote attacker to send arbitrary requests to a remote MWDB instance using the...
EUVD-2026-50332
@fastify/forwarded resolves client addresses from the X-Forwarded-For header. In versions before 3.0.2, when the header contains two or more comma separated entries, the parser trims only space characters and does not strip horizontal tabs, even though RFC 7230 defines optional whitespace as both...
Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: python3.14: python-unversioned-command-3.14.6-2.1.hum1 noarch python3-3.14.6-2.1.hum1 aarch64, x8664 python3-debug-3.14.6-2.1.hum1 aarch64, x8664 python3-devel-3.14.6-2.1.hum1 aarch64, x8664...
CVE-2026-50641
Streamsoft Business Intelligence (BI) stores users’ passwords in plaintext in the database. The issue is mitigated in version 6.8.0.0, and users were also prompted to change their password on first login. Impact is Confidentiality (high) with no reported impact to integrity or availability. The a...
Security Bulletin: IBM WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager is affected by affected by multiple vulnerabilities (CVE-2026-50645, CVE-2026-9322, CVE-2026-9171)
Summary IBM WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager is affected by uncontrolled resource consumption and denial of service. Vulnerability Details CVEID:CVE-2026-50645 DESCRIPTION: There is no restriction on the amount of attachment headers that a...
CVE-2026-50642
diff‑so‑fancy does not properly sanitize non‑SGR terminal control sequences before outputting diff data. The application only strips ANSI SGR sequences while allowing other control characters, including carriage return \r and escape sequences e.g., OSC, CSI, to pass through unsanitized. An attack...
RHSA-2026:45780 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Bulletin has no description...
RHSA-2026:45128 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Bulletin has no description...