8657 matches found
CVE-2026-3129
The LiteSpeed Cache plugin for WordPress (all versions up to and including 7.7 ) is vulnerable to Stored Cross-Site Scripting via crafted tag attributes. The root cause is a flawed regular expression used to strip width and height attributes from images when the "Lazy Load Images" and "Add Missi...
CVE-2026-59289
CVE-2026-59289 affects Spring for GraphQL (versions 2.0.0–2.0.4, 1.4.0–1.4.6, 1.2.0–1.3.9) through a Denial of Service in its Spring Data pagination support. The root cause is that scrollable query arguments are resolved from client-supplied values and forwarded directly to the underlying reposit...
CVE-2026-59289 Spring for GraphQL Denial of Service via pagination support
Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged loa...
CVE-2026-59289 Spring for GraphQL Denial of Service via pagination support
Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged loa...
CVE-2026-81702
openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, enabling silent key substitution . An attacker can replace legitimate public keys in identity stores with their own while maintaining the claimed fingerprint, so that encryption u...
CVE-2026-81702 openssl_encrypt before 1.4.9 Key Substitution via Identity Load
opensslencrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling...
CVE-2023-44487
HTTP/2 Rapid Reset: CVE-2023-44487 Descrizione Questo repository contiene il codice proof-of-concept PoC per la vulnerabilità HTTP/2 Rapid Reset identificata come CVE-2023-44487. Panoramica della vulnerabilità ID CVE : CVE-2023-44487 Impatto : Denial of Service DoS Protocolli interessati : HTTP/2...
Astra Linux – Vulnerability in libstb
stbimage is a single-file library licensed under MIT, used for processing images. If stbiloadgifmain in stbiloadgiffrommemory fails, it returns a null pointer and may leave the z variable uninitialized. If the caller also sets the vertical flipping flag, the process continues by calling...
Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: ip: Fixed data races related to sysctlipprotsock. sysctlipprotsock is accessed concurrently, and there is always a chance of data races occurring. Therefore, both readers and writers require some basic protection to avoid...
Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-5.10
In the Linux kernel, the following vulnerabilities have been resolved: crypto: safexcel – Cleanup of ring IRQ workqueues on load failure A failure to load the safexcel driver results in the following warning upon boot, because the IRQ affinity has not been properly cleaned up. Ensure that we...
Astra Linux – Vulnerability in Thunderbird, Firefox
Module load requests that failed were not checked to determine whether they had been cancelled, resulting in a use-after-free in ScriptLoadContext. This vulnerability affects Firefox 110, Thunderbird 102.8, and Firefox ESR 102.8...
Astra Linux – Vulnerability in pyyaml
PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and loadall functions due to a class deserialization issue. For example, Popen is a class in the subprocess module. NOTE: This issue exists because of an incomplete fix for CVE-2017-18342...
Astra Linux – Vulnerability in Gegl
The loadcache function in GEGL before version 0.4.34 allows shell expansion when a pathname in a constructed command line is not escaped or filtered. This issue arises due to the use of the system library function for executing the ImageMagick convert fallback in magick-load. NOTE: GEGL versions...
Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: fs/binfmtelf: A memory leak was fixed in loadelfbinary. There is also a memory leak reported by kmemleak: Unreferenced object: 0xffff88817104ef80 size: 224 Reported by comm "xfsadmin", pid 47165, jiffies: 4298708825 age: 1333.476...
Astra Linux – Vulnerability in ffmpeg, ffmpeg5
FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a negative-size-param bug at libavcodec/mpegvideoenc.c:1216:21 in loadinputpicture in FFmpeg7.0...
Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fixed a NULL dereference bug. The issue arises when this function is called from ntfsloadattrlist. The value of “size” is calculated as le32tocpuattr-res.datasize. On 64-bit systems, this does not cause an overflow, but...
Astra Linux – Vulnerability in ffmpeg5
A flaw was discovered in FFmpeg. This vulnerability allows for unexpected additional CPU load and storage consumption, potentially leading to reduced performance or denial of service due to the demuxing of arbitrary data as XBIN-format data without proper format validation...
Astra Linux – Vulnerability in pyyaml
A vulnerability was discovered in the PyYAML library in versions prior to 5.3.1. In these versions, the library is susceptible to arbitrary code execution when it processes untrusted YAML files using the fullload method or the FullLoader loader. Applications that use this library to process...
Astra Linux – Vulnerability in Qemu
An infinite loop flaw was discovered in the e1000 NIC emulator of QEMU. This issue occurs when processing transmit tx descriptors in processtxdesc, especially if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host, resulting in...