46 matches found
CVE-2026-5423 Subscription Authentication Bypass via Unverified connectionParams.jwt
@neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. As a result, any unauthenticated remote client that can open a GraphQL-over-WebSocket connection can forge arbitrary JW...
CVE-2026-15928
XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting XSS vulnerability in the error page component...
UBUNTU-CVE-2026-47057
Vulnerability in Oracle Java SE component: Scripting. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attack...
GO-2026-5095 Grafana public dashboards disclose all direct mode datasources in github.com/grafana/grafana
Grafana public dashboards disclose all direct mode datasources in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
UBUNTU-CVE-2026-25834
Mbed TLS v3.3.0 up to 3.6.5 and 4.0.0 allows Algorithm Downgrade...
CVE-2026-24975
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NooTheme Organici Library noo-organici-library allows Reflected XSS.This issue affects Organici Library: from n/a through = 2.1.2...
CVE-2026-4438
The GNU C Library (glibc) , specifically versions 2.34 to 2.43 , is vulnerable to an issue where calling the gethostbyaddr or gethostbyaddr_r functions with a configured nsswitch.conf specifying the library's DNS backend can result in an invalid DNS hostname being returned. This behavior violates...
CVE-2026-21490 iccDEV has heap buffer overflow in CIccTagLut16::Validate()
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium ICC color management profiles. A vulnerability present in versions prior to 2.3.1.2 affects users of the iccDEV library who process ICC color profiles. It...
EUVD-2026-1148
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below have overflows and underflows in CIccXmlArrayType::ParseTextCountNum. This vulnerability affects users of the iccDEV library who process ICC color profiles. This issue is fixed in...
Huawei EulerOS: Security Advisory for glibc (EulerOS-SA-2025-2356)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2025-11573
An infinite loop issue in Amazon.IonDotnet library versions...
EUVD-2020-3563
Malware in sbrugna...
CVE-2025-36239
IBM Storage TS4500 Library 1.11.0.0 and 2.11.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...
CVE-2024-43192
IBM Storage TS4500 Library 1.11.0.0 and 2.11.0.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...
ALSA-2025:8636 Important: perl-FCGI security update
FastCGI Perl bindings. Security Fixes: perl-fcgi: FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 aka fcgi library CVE-2025-40907 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related...
CVE-2025-28866
Cross-Site Request Forgery CSRF vulnerability in smerriman Login Logger allows Cross Site Request Forgery. This issue affects Login Logger: from n/a through 1.2.1...
SUSE-SU-2024:4407-1 Security update for aalto-xml, flatten-maven-plugin, jctools, moditect, netty, netty-tcnative
This update for aalto-xml, flatten-maven-plugin, jctools, moditect, netty, netty-tcnative fixes the following issues: - CVE-2024-47535: Fixed unsafe reading of large environment files when Netty is loaded by a java application can lead to a crash due to the JVM memory limit being exceeded in nett...
AZL-54449 CVE-2024-45338 affecting package ig for versions less than 0.32.0-3
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...
PT-2024-31956 · Public Knowledge · Pkp-Lib
Name of the Vulnerable Software and Affected Versions: Public Knowledge Project pkp-lib versions 3.4.0-7 and earlier Description: The issue is related to an Open redirect vulnerability due to a lack of input sanitization in the logout function. Recommendations: For Public Knowledge Project pkp-li...