CVE-2026-21860

Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safejoin function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows, there are special device names such as CON, AUX, etc that are implicitly present...

CVE-2026-21860

Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safejoin function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows, there are special device names such as CON, AUX, etc that are implicitly present...

EUVD-2026-1425

Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safejoin function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows, there are special device names such as CON, AUX, etc that are implicitly present...

mariadb: MariaDB Server Crash

A flaw was found in MariaDB Server. This vulnerability may allow an attacker to cause a crash via improper handling of join operations in JOIN::fixallsplittingsinplan...

mariadb: MariaDB Server Crash

A flaw was found in MariaDB Server. This vulnerability may allow an attacker to cause a crash via improper handling of join operations in JOIN::fixallsplittingsinplan...

mariadb: MariaDB Server Crash

A flaw was found in MariaDB Server. This vulnerability may allow an attacker to cause a crash via improper handling of join operations in JOIN::fixallsplittingsinplan...

PT-2026-2107

Name of the Vulnerable Software and Affected Versions Werkzeug versions prior to 3.1.5 Description Werkzeug’s safe join function improperly handles path segments containing Windows device names with file extensions or trailing spaces. Windows device names, such as CON and AUX, are implicitly...

Werkzeug 安全漏洞

Werkzeug is a comprehensive WSGI web application library open-sourced by Pallets. A security vulnerability exists in Werkzeug versions prior to 3.1.5 that stems from the safejoin function allowing path segments that contain Windows device names, which could lead to security issues...

mariadb: MariaDB Server Crash

A flaw was found in MariaDB Server. This vulnerability may allow an attacker to cause a crash via improper handling of join operations in JOIN::fixallsplittingsinplan...

CVE-2022-27932

Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join...

CVE-2022-27933

Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join...

mariadb: MariaDB Server Crash

A flaw was found in MariaDB Server. This vulnerability may allow an attacker to cause a crash via improper handling of join operations in JOIN::fixallsplittingsinplan...

WordPress ProfileGrid plugin <= 5.9.4.4 - Missing Authorinzation to Authenticated (Subscriber+) Join Group Requests Management vulnerability

Missing Authorinzation to Authenticated Subscriber+ Join Group Requests Management vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin ProfileGrid versions = 5.9.4.4...

ALPINE-CVE-2025-61594

URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier bundled in Ruby 3.2 series 0.13.2 and earlier bundled in Ruby 3.3 series, 1.0.3 and earlier bundled in Ruby 3.4 series, when using the + operator to combine URIs, sensitive information like...

AZL-73356 CVE-2025-61594 affecting package ruby for versions less than 3.3.5-7

URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier bundled in Ruby 3.2 series 0.13.2 and earlier bundled in Ruby 3.3 series, 1.0.3 and earlier bundled in Ruby 3.4 series, when using the + operator to combine URIs, sensitive information like...

CVE-2025-61594

URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier bundled in Ruby 3.2 series 0.13.2 and earlier bundled in Ruby 3.3 series, 1.0.3 and earlier bundled in Ruby 3.4 series, when using the + operator to combine URIs, sensitive information like...

CVE-2025-61594

The CVE concerns the URI Ruby module. In versions ≤0.12.4 (Ruby 3.2), ≤0.13.2 (Ruby 3.3), and ≤1.0.3 (Ruby 3.4), using the + operator to join URIs could leak passwords from the original URI, bypassing a prior fix for CVE-2025-27221 and exposing credentials. Mitigations are available in fixed rele...

CVE-2025-49088

Pexip Infinity 32.0 through 37.1 before 37.2, in certain configurations of OTJ One Touch Join for Teams SIP Guest Join, has Improper Input Validation in the OTJ service, allowing a remote attacker to trigger a software abort via a crafted calendar invite, leading to a denial of service...

CVE-2025-57403

Cola Dnslog v1.3.2 is vulnerable to Directory Traversal. When a DNS query for a TXT record is processed, the application concatenates the requested URL or a portion of it directly with a base path using os.path.join. This bypass allows directory traversal or absolute path injection, leading to th...

CVE-2025-57403

Cola Dnslog v1.3.2 is vulnerable to Directory Traversal and absolute path injection within its DNS query processing component. The flaw occurs when the application processes a DNS query for a TXT record by directly concatenating the requested URL (or a portion of it) with a base path using os.pat...