CVE-2026-90775

PostGIS addressstandardizer through 3.7.0 fails to validate the Weight parameter from caller-supplied rules tables before using it as an array index. Attackers can craft malicious rule rows with out-of-range Weight values to trigger out-of-bounds reads in the loadvalue array, causing the PostgreS...

CVE-2026-90779 SIPp through 3.7.7 Stack Buffer Overflow via createAuthHeader Algorithm Parameter

SIPp through 3.7.7 contains a stack buffer overflow vulnerability in createAuthHeader when processing SIP authentication challenges with oversized algorithm parameters. A malicious SIP server can send a crafted 401 or 407 challenge to corrupt the stack and crash the client process...

CVE-2026-90779 SIPp through 3.7.7 Stack Buffer Overflow via createAuthHeader Algorithm Parameter

SIPp through 3.7.7 contains a stack buffer overflow vulnerability in createAuthHeader when processing SIP authentication challenges with oversized algorithm parameters. A malicious SIP server can send a crafted 401 or 407 challenge to corrupt the stack and crash the client process...

CVE-2026-90779

SIPp through version 3.7.7 is affected by a stack buffer overflow in the createAuthHeader() function. The vulnerability is triggered when processing SIP authentication challenges (HTTP 401 or 407) containing oversized algorithm parameters , allowing a malicious SIP server to corrupt the stack and...

CVE-2026-90779 SIPp through 3.7.7 Stack Buffer Overflow via createAuthHeader Algorithm Parameter

SIPp through 3.7.7 contains a stack buffer overflow vulnerability in createAuthHeader when processing SIP authentication challenges with oversized algorithm parameters. A malicious SIP server can send a crafted 401 or 407 challenge to corrupt the stack and crash the client process...

EUVD-2026-77003

SIPp through 3.7.7 contains a stack buffer overflow vulnerability in createAuthHeader when processing SIP authentication challenges with oversized algorithm parameters. A malicious SIP server can send a crafted 401 or 407 challenge to corrupt the stack and crash the client process...

CVE-2026-90769

Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allowing authenticated users to perform server-side requests to internal services. Attackers can supply arbitrary URLs to read cloud metadata, internal network services, and localhost-bound services...

CVE-2026-90775 PostGIS address_standardizer through 3.7.0 Out-of-Bounds Read via Unvalidated Rule Weight

PostGIS addressstandardizer through 3.7.0 fails to validate the Weight parameter from caller-supplied rules tables before using it as an array index. Attackers can craft malicious rule rows with out-of-range Weight values to trigger out-of-bounds reads in the loadvalue array, causing the PostgreS...

EUVD-2026-76997

PostGIS addressstandardizer through 3.7.0 fails to validate the Weight parameter from caller-supplied rules tables before using it as an array index. Attackers can craft malicious rule rows with out-of-range Weight values to trigger out-of-bounds reads in the loadvalue array, causing the PostgreS...

CVE-2026-90775 PostGIS address_standardizer through 3.7.0 Out-of-Bounds Read via Unvalidated Rule Weight

PostGIS addressstandardizer through 3.7.0 fails to validate the Weight parameter from caller-supplied rules tables before using it as an array index. Attackers can craft malicious rule rows with out-of-range Weight values to trigger out-of-bounds reads in the loadvalue array, causing the PostgreS...

CVE-2026-90775

PostGIS address_standardizer versions through 3.7.0 fail to validate the Weight parameter from caller-supplied rules tables before using it as an array index in the load_value array. Attackers with low privileges can craft malicious rule rows with out-of-range Weight values, triggering an out-of-...

CVE-2026-90775

PostGIS addressstandardizer through 3.7.0 fails to validate the Weight parameter from caller-supplied rules tables before using it as an array index. Attackers can craft malicious rule rows with out-of-range Weight values to trigger out-of-bounds reads in the loadvalue array, causing the PostgreS...

CVE-2026-90775 PostGIS address_standardizer through 3.7.0 Out-of-Bounds Read via Unvalidated Rule Weight

PostGIS addressstandardizer through 3.7.0 fails to validate the Weight parameter from caller-supplied rules tables before using it as an array index. Attackers can craft malicious rule rows with out-of-range Weight values to trigger out-of-bounds reads in the loadvalue array, causing the PostgreS...

CVE-2026-90769 Open Notebook before 1.11.0 Server-Side Request Forgery via link-source

Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allowing authenticated users to perform server-side requests to internal services. Attackers can supply arbitrary URLs to read cloud metadata, internal network services, and localhost-bound services...

CVE-2026-90769

Open Notebook before 1.11.0 contains a Server-Side Request Forgery (SSRF) vulnerability in the POST /api/sources endpoint. The application fails to validate the URL parameter, allowing any authenticated user to supply arbitrary URLs that the server will fetch directly. This enables attackers to r...

CVE-2026-90769 Open Notebook before 1.11.0 Server-Side Request Forgery via link-source

Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allowing authenticated users to perform server-side requests to internal services. Attackers can supply arbitrary URLs to read cloud metadata, internal network services, and localhost-bound services...

EUVD-2026-76990

Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allowing authenticated users to perform server-side requests to internal services. Attackers can supply arbitrary URLs to read cloud metadata, internal network services, and localhost-bound services...

CVE-2026-90769 Open Notebook before 1.11.0 Server-Side Request Forgery via link-source

Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allowing authenticated users to perform server-side requests to internal services. Attackers can supply arbitrary URLs to read cloud metadata, internal network services, and localhost-bound services...

Exploit for CVE-2026-71294

Cotonti CommentsWidget PHP Object Injection PoC Safe local pr...

Bastillion v5.2.1

Bastillion A modern, web-based SSH console and SSH key management tool. Bastillion gives you a clean, browser-based way to manage SSH access across all your systems — like a bastion host with a friendly dashboard. It does two things: 1. Web-based SSH terminal — once a host is registered, authoriz...