210752 matches found
CVE-2026-63337
The RabbitMQ Java client (pre-5.33.0) passes an untrusted javaReturnType from system.describe through Class.forName with initialization enabled, allowing an attacker controlling broker responses to trigger arbitrary class static initializers in the victim JVM, affecting confidentiality, integrity...
CVE-2026-63337
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.tools.jsonrpc.ProcedureDescription receives a javaReturnType value in an untrusted system.describe response and passes it through JSONUtil.tryFill,...
CVE-2026-46482
Impact The registration component does not validate the text-based Security Question CAPTCHA correctly, allowing attackers to bypass the challenge via a specially crafted value. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Details The public Registration workflow member.php?action=doregister...
CVE-2026-47245
In MyBB versions prior to 1.8.40, the usercp.php?action=do_editlists delete handler performs a reciprocal buddy-list update that searches for the target UID instead of the acting user's UID and uses the unchecked array_search() return value as an array key. When array_search() returns false, it i...
CVE-2026-47245 MyBB: Buddy list corruption
MyBB is free and open source forum software. Prior to 1.8.40, the User CP Buddy/Ignore List component does not validate reciprocal buddy-list updates correctly. The usercp.php?action=doeditlists delete handler removes the selected entry from the acting user's list and then updates...
EUVD-2026-60968
The Entries component in Brainstorm Force SureForms version, less than 2.1.3, does not enforce adequate limits on user-controlled form fields or submitted content during processing and rendering, which allows a remote attacker to exhaust server resources, prevent administrators from accessing the...
CVE-2026-75904
libmodplug ≤0.8.9.1 has an out-of-bounds read in pat_smplooped (src/load_pat.cpp): an smpno of zero indexes pat_loops[-1]. A crafted 32-byte MIDI file via ModPlug_Load triggers it through CSoundFile::Create, CSoundFile::ReadMID, and MID_ReadPatterns. Adjacent static storage influences playback st...
CVE-2026-75859 CodeWhale before 0.8.64 Arbitrary File Read via instructions
CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing attackers to read arbitrary files on the victim's system. A malicious .codewhale/config.toml file in a cloned repository can specify paths outside the workspace that are read and inject...
CVE-2026-59949
yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance.hash32.hash, XXHashFactory.nativeInstance.hash64.hash,...
CVE-2026-67214
A flaw was found in nanoid Nano ID, a JavaScript library used for generating unique identifiers. This vulnerability allows an attacker to cause a Denial of Service DoS by providing a negative size input to the customAlphabet or nanoid functions within the library's non-secure module. When a...
CVE-2026-59949
yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance.hash32.hash, XXHashFactory.nativeInstance.hash64.hash,...
CVE-2026-59949
In lz4-java prior to 1.11.1, JNI-backed XXHash methods (hash32, hash64, streaming hash update) pass unvalidated byte arrays and off/len ranges to native code, enabling null-array or out-of-bounds reads that crash the JVM. Upgrade to 1.11.1. No in-the-wild exploitation reported. https://github.com...
GO-2026-6233 Openshift Migration Advisor: Improper input sanitization allows specially crafted RVTools .xlsx files to include malicious SQL commands in github.com/kubev2v/migration-planner
Openshift Migration Advisor: Improper input sanitization allows specially crafted RVTools .xlsx files to include malicious SQL commands in github.com/kubev2v/migration-planner...
GO-2026-6147 Apache Answer has an Improper Neutralization of Alternate XSS Syntax vulnerability in github.com/apache/answer
Apache Answer has an Improper Neutralization of Alternate XSS Syntax vulnerability in github.com/apache/answer...
MINI-4PQC-4FFF-7VJQ
Bulletin has no description...
CVE-2026-71226 affecting package libkcapi for versions less than 1.5.1-1
CVE-2026-71226 affecting package libkcapi for versions less than 1.5.1-1. An upgraded version of the package is available that resolves this issue...
MINI-7WRQ-VF36-G468
Bulletin has no description...
CVE-2026-73345 WordPress License Manager for WooCommerce plugin <= 3.0.18 - SQL Injection vulnerability
Customer SQL Injection in License Manager for WooCommerce = 3.0.18 versions...