212069 matches found
EUVD-2026-38570
Ash: Private action arguments can be set by user input via string-keyed params and atomic changesets...
CVE-2026-93543
A flaw was found in libXi. An out-of-bounds read vulnerability in the X Input 2 XI2 class parser allows a malicious X server to cause a Denial of Service DoS by crashing connected client applications. When an application receives and processes specially crafted input from the server, insufficient...
CVE-2026-93542
A flaw was found in libXi. An out-of-bounds read vulnerability occurs during the parsing of X Input Extension XI2 device class data. A malicious X server can exploit this vulnerability by sending specially crafted class responses to a connected client application. This causes the client to read...
UBUNTU-CVE-2026-93826
In the Linux kernel, the following vulnerability has been resolved: HID: hidpp: fix potential UAF in hidppconnectevent If inputregisterdevice fails, we call inputfreedevice, but keep stale pointer to the old device in hidpp-input, which could potentially lead to UAF. Fix that by resetting it to...
EUVD-2026-86299
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unescaped SQL LIKE metacharacters to upload-resolution patterns, causing wildcard input to select unrelated upload records instead of matching a literal identifie...
CVE-2026-91133 Discourse: Escape LIKE metacharacters in upload paths to prevent disclosure
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unescaped SQL LIKE metacharacters to upload-resolution patterns, causing wildcard input to select unrelated upload records instead of matching a literal identifie...
CVE-2026-91133
The open-source discussion platform Discourse is vulnerable to an information disclosure flaw in versions prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0 . Authenticated users can provide unescaped SQL LIKE metacharacters in upload-resolution patterns. This allows wildcard input to select unr...
CVE-2026-91133 Discourse: Escape LIKE metacharacters in upload paths to prevent disclosure
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unescaped SQL LIKE metacharacters to upload-resolution patterns, causing wildcard input to select unrelated upload records instead of matching a literal identifie...
RHLW-2026-C69885B4933C8262 Lightwell Security Advisory: xstream 1.4.18.rhlw-00006
Red Hat Lightwell has released com.thoughtworks.xstream:xstream 1.4.18.rhlw-00006 with backported fixes for CVE-2021-43859, CVE-2022-41966, and CVE-2024-47072. CVE-2021-43859: XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a...
EUVD-2026-86280
authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik email authenticator enrollment during an authentication or enrollment flow accepts a recipient address supplied in the setup request instead of using the address already established by the flow. An...
CVE-2025-32000
HCL Sametime is vulnerable to insufficient input sanitization. The application did not appropriately sanitize user input. When user input is implicitly or explicitly trusted without sufficient sanitization, malicious actors can leverage this vulnerability...
EUVD-2026-86260
MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have...
CVE-2025-32000 Insufficient Input Sanitization is addressed in HCL Sametime 12.0.4. It is recommended to upgrade to the latest version.
HCL Sametime is vulnerable to insufficient input sanitization. The application did not appropriately sanitize user input. When user input is implicitly or explicitly trusted without sufficient sanitization, malicious actors can leverage this vulnerability...
CVE-2025-32000
The HCL Sametime application is vulnerable to insufficient input sanitization due to the improper sanitization of user input. This flaw allows malicious actors to leverage implicitly or explicitly trusted input to target the application. Impacted versions are addressed in HCL Sametime 12.0.4 . It...
CVE-2025-32000 Insufficient Input Sanitization is addressed in HCL Sametime 12.0.4. It is recommended to upgrade to the latest version.
HCL Sametime is vulnerable to insufficient input sanitization. The application did not appropriately sanitize user input. When user input is implicitly or explicitly trusted without sufficient sanitization, malicious actors can leverage this vulnerability...
EUVD-2025-210999
HCL Sametime is vulnerable to insufficient input sanitization. The application did not appropriately sanitize user input. When user input is implicitly or explicitly trusted without sufficient sanitization, malicious actors can leverage this vulnerability...
Improper Input Validation
Apache ActiveMQ is vulnerable to improper input validation. The vulnerability is due to insufficient validation of the clientId when removing a durable topic subscription, which allows an authenticated attacker to spoof a client ID and potentially remove another client's durable topic subscriptio...
openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages
A flaw was found in OpenSSL's Cryptographic Message Services CMS AuthEnvelopedData processing. An on-path attacker can exploit insufficient input validation on cipher and tag length fields by sending specially crafted CMS messages. This can lead to the forging of messages or bypassing integrity...
html/template: golang: Go html/template: Cross-Site Scripting via pathological input
A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...
Astra Linux – Vulnerability in Chromium
Improper input validation in Chromium in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to spoof UI elements via crafted network traffic. Chromium security severity: Low...