CVE-2022-41404 vulnerabilities

Vulnerabilities for packages: druid...

GHSA-X5MV-8WGW-29HG vulnerabilities

Vulnerabilities for packages: ascan...

EUVD-2026-62969

In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored da...

EUVD-2026-62916

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could use crafted report notification data to cause Splunk Secure Gateway to send a request to...

EUVD-2026-62909

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could write dispatch metadata to an arbitrary location on the host by supplying a crafted search identifier to a Representational State Transfer REST API endpoint a...

EUVD-2026-62897

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into opening a crafted link to Analytics Workspace. When the authenticated user opens the link, Splunk Enterprise runs attacker-controlled Search Processing Language S...

EUVD-2026-63121

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could perform Remote Code Execution RCE by submitting crafted Splunk Web Manager Configuration content. The user could then access all relevant data and affect syst...

postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists

A flaw was found in PostgreSQL pgdump. A heap buffer overflow vulnerability exists when processing long function transform lists. An authenticated object creator can exploit this by providing a specially crafted transform list. This allows the attacker to execute arbitrary code as the operating...

Missing Release of Resource after Effective Lifetime

Overview org.springframework:spring-messaging is a framework and inversion of control container for the Java platform. Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via the RSocketMessageHandler process when handling a malformed SETUP...

CVE-2026-73258: Incorrect Comparison

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mghttpnextmultipart in src/http.c. The loops comparing sb and sb + 1, and sh2 and sh2 + 1, use an incorrect AND condition and stop...

CVE-2026-70105: Improper Input Validation

Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information over a network...

PT-2026-79139

Name of the Vulnerable Software and Affected Versions @dicebear/core versions prior to 9.4.3 @dicebear/initials versions prior to 9.4.3 Description An issue exists where certain options are interpolated into SVG attributes without XML escaping. In @dicebear/core, the addRotate function fails to...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the evaluation of user-supplied SpEL expressions containing the power operator ^ with a BigDecimal or BigInteger operand and a large exponent value. An attacker can cause excessive...

Cudy WR3000 Authentication Bypass / Command Injection

Cudy WR3000 routers suffer from authentication bypass vulnerability due to a hard-coded secret and a code injection vulnerability via unsanitized input...

PT-2026-81878

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.20 through 11.0.24 Apache Tomcat versions 10.1.53 through 10.1.57 Apache Tomcat versions 9.0.115 through 9.0.120 Description Improper input validation occurs due to an incomplete fix for a previous issue...

HTTP Response Splitting

Overview org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform. Affected versions of this package are vulnerable to HTTP Response Splitting via the...

SQL Injection

Overview org.springframework.data:spring-data-jpa is a package that is used to implement JPA based repositories. Affected versions of this package are vulnerable to SQL Injection in the validation of Sort parameters when crafted payloads are accepted from untrusted sources and used without prior...

PT-2026-79217

Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information over a network...

PT-2026-79167

Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 and 7.3 IBM PowerVM VIOS version 4.1 Description Improper validation of symbolic links allows a local attacker to cause a denial of service. Recommendations At the moment, there is no information about a newer version that...

cve-2026-47851 - HIGH - Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader

cve-2026-47851 - HIGH - Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader...