212655 matches found
Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input
A new security vulnerability in Next.js could allow attackers to run code on a server via ImageResponse, the feature that generates Open Graph and other social preview images, Vercel said. The risk applies when an app puts values an attacker controls, such as text read from the request URL, into...
RLSA-2026:69655 Moderate: libxml2 security, bug fix, and enhancement update
The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free CVE-2026-6653 Bug Fixes and Enhancements: libxml2: CVE-2025-9714 fix Rocky Linux-11927...
libxml2 security, bug fix, and enhancement update
An update is available for libxml2. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The libxml2 library is a development toolbox providing the implementation of...
html/template: golang: Go html/template: Cross-Site Scripting via pathological input
A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...
Malware in bnpl-blocks-atom-bnpl-search-input
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
EUVD-2026-84955
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to cause a denial of service due to the improper use of reflection with externally controlled input...
EUVD-2026-84953
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute arbitrary JavaScript in an authenticated user's browser due to improper neutralization of HTML input...
CVE-2026-82407: Improper Input Validation
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, core/kapp/validators/validators.go Register and the runtime validator update path accept a submitted BLSPublicKey without curve, prime-order subgroup, or nonzero validation. When a validator with a malformed ke...
CVE-2026-62998: Improper Input Validation
REDAXO is a PHP-based content management system. Prior to 5.21.2, rexlist::getSortColumn in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable registered the requested column. An authenticated backend user can make prepareQuery add an escape...
Linux Distros Unpatched Vulnerability : CVE-2026-95381
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in Printing. CVE-2026-95381 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C...
Linux Distros Unpatched Vulnerability : CVE-2026-95382
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in Auth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process and leveraged socia...
PT-2026-97295
Name of the Vulnerable Software and Affected Versions AVESİS versions 202608201331 through 202608240351 Description An open redirect issue exists in Abis Technology Ltd. Co. AVESİS, which allows for input data manipulation by redirecting users to untrusted sites. Recommendations Update AVESİS to...
ROS-20260923-73-0003
The vulnerability in python-black is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to cause service failures...
Google Chrome Microsoft Edge DoS
The vulnerability in the Linux Toolkit Theming component of Google Chrome and Microsoft Edge web browsers is related to insufficient input validation. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service...
Google Chrome Microsoft Edge Code Execution
The vulnerability of the File Input component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...
Google Chrome Microsoft Edge Code Execution
The Input component vulnerability in Google Chrome and Microsoft Edge web browsers is related to use-after-free memory usage. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary code...
PT-2026-97255
Name of the Vulnerable Software and Affected Versions Apache Sling XSS versions prior to 2.4.12 Description Improper neutralization of input during web page generation leads to a cross-site scripting XSS issue. Cross-site scripting is a flaw where an application includes untrusted data in a web...
NVIDIA Display Driver DoS
The vulnerability of NVIDIA Display Driver and Guest drivers for NVIDIA virtual graphics processors is related to insufficient control over input data. Exploiting this vulnerability can allow attackers to cause system failures...
ODPure: Backdoor Purification for Object Detection Via Ensemble Corruption Consensus
With the development of applications like autonomous driving, object detection has gained significant attention, while also highlighting critical vulnerabilities like backdoor attacks that severely compromise model integrity. Specifically, such attacks involve altering the categories of objects...