212718 matches found
Malicious code in homestack-cheer (npm)
Source: amazon-inspector f475cd8b8a3e1dd4563ca0b20d85fde83576ed78c27eb91ca1cd77fbebe0d142 The package is published as homestack-cheer with description 'JS lib support cheerleading', but the README and the UMD build dist/my-lib.umd.js present it as a trivial hello-world 'greet' library. The ESM...
chromium-browser: angle: ANGLE in Google Chrome: Arbitrary code execution via improper input validation
A flaw was found in ANGLE, a component of Google Chrome. Improper input validation could allow a remote attacker to execute arbitrary code outside of the browser's security sandbox by enticing a user to visit a specially crafted HTML page. This could lead to a complete compromise of the affected...
EUVD-2026-84189
FalkorDB Redis module v4.20.1 to v4.20.4 was discovered to contain a buffer overflow in the DecodeGrBMatrix function /v19/decodematrix.c. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted input...
CVE-2026-73552: Improper Input Validation
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy HTTP RBAC accepts RFC-valid opaque header bytes but evaluates saferegex values with RE2's UTF-8 subject semantics. A downstream client can preserve a prohibit...
CVE-2026-94379: Improper Input Validation
The login function in MISP's UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allowlist approach, checking only for specific HTTP methods POST and PUT before enforcing bruteforce protection, email one-time-passwo...
Oracle Linux 10 : tomcat (ELSA-2026-69259)
The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-69259 advisory. - Resolves: RHEL-192817 tomcat: HTTP/2 request headers not validated CVE-2026-41293 - Resolves: RHEL-192648 tomcat: Improper Input Validation...
CVE-2026-49453: Improper Input Validation
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, Joplin accepts synchronized resource metadata whose id or fileextension contains parent-directory or path-separator characters. BaseItem.unserialize stores the...
ROS-20260921-73-0094
The vulnerability is related to insufficient checking of unusual or exceptional states. Exploiting this vulnerability can allow a remote attacker to cause service failures...
OpenSSL ocsp_responders() function Data Compromise
The vulnerability of the ocspresponers function in the openssl/src/x509/mod.rs library of the OpenSSL library is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of the protected information...
CVE-2026-73547: Improper Input Validation
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's extauthz filter assumes that a request contains a :path pseudoheader when applying queryparameterstoset or queryparameterstoremove from an authorization...
RHEL 8 : libxml2 (RHSA-2026:69655)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:69655 advisory. The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: mingw-libxml2: libxml2:...
ROS-20260921-73-0081
The vulnerability is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to cause service failures...
CVE-2026-73552: Improper Input Validation
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy HTTP RBAC accepts RFC-valid opaque header bytes but evaluates saferegex values with RE2's UTF-8 subject semantics. A downstream client can preserve a prohibit...
CVE-2026-73552: Improper Input Validation
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy HTTP RBAC accepts RFC-valid opaque header bytes but evaluates saferegex values with RE2's UTF-8 subject semantics. A downstream client can preserve a prohibit...
CVE-2026-73513: Improper Input Validation
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's optional oghttp2 upstream HTTP/2 codec accepts a response trailer HEADERS frame without ENDSTREAM. Envoy completes and deferred-deletes the ActiveRequest...
CVE-2026-73513: Improper Input Validation
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's optional oghttp2 upstream HTTP/2 codec accepts a response trailer HEADERS frame without ENDSTREAM. Envoy completes and deferred-deletes the ActiveRequest...
CVE-2026-77166: Undefined Security Weakness
The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items...
ROS-20260921-73-0041
The vulnerability in the kernel-lt is related to errors in processing input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
TOTOLINK A3300R SetVpnPassCfg Command Execution
The vulnerability of the setVpnPassCfg function in TOTOLINK A3300R router microprogramming software is related to the lack of measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
