1352 matches found
CVE-2021-31583
creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:45+00:00| seen| https://t.me/hackingAttack/6156 2026-09-02 01:03:20+00:00| seen| https://t.me/hackingAttack/6156 2026-09-08 10:00:07+00:00| published-proof-of-concept| https://t.me/hackingAttack/6156 2026-09-09 00:00:34+00:00|...
CVE-2026-84267 Gvfs: sftp: uninitialized heap disclosure in read_string()
A flaw was found in the SFTP backend in gvfs. When mounting a share, a malicious SFTP server can cause readstring to allocate a buffer with a certain length but the function does not verify that the buffer is completely filled, leaving the remainder of the buffer containing uninitialized heap...
CVE-2026-79685
Dell PowerStore contains an Argument Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to gain unauthorized access to sensitive sensitive system information...
SUSE-SU-2026:23443-1 Security update for lcms2
This update for lcms2 fixes the following issues: - CVE-2026-41254: Information disclosure or denial of service via integer overflow in CubeSize bsc1264994. - CVE-2026-42798: Little CMS lcms2 2.16 through 2.18 before 2.19 has an integer overflow in ParseCube in cmscgats.c bsc1263703. Changes for...
CVE-2026-80709
A flaw was found in the Linux kernel's s390/zcrypt component. An incorrect upper limit check for the domain value when processing an EP11 Cryptographic Coprocessor Request Block CPRB can allow a local user on custom device nodes to access heap memory. This could lead to information disclosure or...
CVE-2026-19948
The Cozy Blocks WordPress plugin (all versions up to and including 2.2.17 ) is vulnerable to authorization bypass . Multiple block renderers unconditionally emit the sidebarNonce value into public page HTML with no login gate, allowing unauthenticated visitors to harvest a valid nonce and pass th...
CVE-2026-77950
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashtypescript allows an unauthenticated attacker to receive unredacted internal error data by provoking an error shape the configured error handler does not match. applyerrorhandler/3 in...
EEF-CVE-2026-82733 Route handler return value echoed into AshTypescript error response
Summary Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashtypescript allows an unauthenticated attacker to read internal application data from an HTTP 500 response body. When a typed-controller route handler returns anything other than a %Plug.Conn,...
ASB-A-484928416
In getQueryBuilderInternal of MediaProvider.java, there is a possible way to retrieve location metadata due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-18374
A flaw was found in the GNU C Library glibc. This vulnerability could allow an attacker with local access to trigger a heap buffer overflow by manipulating how the fopen function handles certain input. This could lead to minor disruptions in system operations or limited access to sensitive...
kernel: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()
A flaw was found in the Linux kernel's Direct Rendering Manager DRM Graphics Execution Manager GEM component. This vulnerability arises from an inconsistent calculation of plane dimensions, which can lead to incorrect memory allocation checks. A local attacker could exploit this by creating a...
Important: dotnet10.0
Issue Overview: Inconsistent interpretation of http requests 'http request/response smuggling' in .NET allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-62899 Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized...
Important: dotnet9.0
Issue Overview: Inconsistent interpretation of http requests 'http request/response smuggling' in .NET allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-62899 Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized...
Amazon Linux 2023 : aspnetcore-runtime-10.0, aspnetcore-runtime-dbg-10.0, aspnetcore-targeting-pack-10.0 (ALAS2023-2026-2094)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2094 advisory. Inconsistent interpretation of http requests 'http request/response smuggling' in .NET allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-62899 Improper...
CVE-2026-81322
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ashcloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts...
CVE-2026-55860
creationtimestamp| type| source ---|---|--- 2026-08-29 01:40:29+00:00| seen| https://gist.github.com/alon710/607da531ae276a39a8c057ba4505abda...
CVE-2026-17203
IBM Administration Runtime Expert for i 1R1M0 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication enforcement...
CVE-2026-18904
IBM Langflow OSS versions 1.0.0 through 1.11.1 are affected by an authorization bypass (CWE-639) stemming from a namespace collision between user identifiers . The public flow metadata endpoint exposes the owner's user_id, which an unauthenticated attacker can reuse as a client_id to collide with...
CVE-2026-55584
phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSIALLOWED access-control check in readconfig.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTEADDR. A remote unauthenticated attacker can supply an allowed address ...
CVE-2026-51640
Incorrect access control in the getMeshNeighborTable function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain mesh neighbor information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...