20637 matches found
CVE-2026-67869
Buffer Overflow vulnerability in open62541 v1.5.5 allows a remote attacker to cause a denial of service via the ServiceCall validates input arguments against runtime-resolved InputArguments metadata...
CVE-2026-43622: Mismatched Memory Management Routines
llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new1batch allocates memory using malloc while free1batch deallocates it using the C++ delete operator, causing heap metadata corruption. Attackers can trigger this memory management...
PT-2026-68455
Name of the Vulnerable Software and Affected Versions Apache Polaris affected versions not specified Description An authenticated principal with permissions to register tables or views can cause the system to use catalog storage credentials to read a selected Iceberg metadata file before verifyin...
PT-2026-68618
Name of the Vulnerable Software and Affected Versions llama.cpp versions b1886 through b7445 Description A double free issue exists in the LLaMA-Android JNI wrapper. The new 1batch function allocates memory using malloc, but the free 1batch function deallocates it using the C++ delete operator...
CVE-2026-41861: Improper Limitation of a Pathname to a Restricted Directory
Path Traversal in BOSH-Ecosystem / BOSH allows an IaaS-metadata attacker to make the agent write a root-owned file with partially attacker-controlled body to any path ending in .network, and create any missing parent directories with mode 0777 via network Alias on Ubuntu. Affected versions: BOSH...
PT-2026-68631
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a privileged user in one tenant to perform operation...
EulerOS 2.0 SP15 : libsolv (EulerOS-SA-2026-2934)
According to the versions of the libsolv packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in libsolv. This stack-based buffer overflow vulnerability occurs in libsolv's Debian metadata parser when processing specially...
EulerOS 2.0 SP15 : libsolv (EulerOS-SA-2026-2893)
According to the versions of the libsolv packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in libsolv. This stack-based buffer overflow vulnerability occurs in libsolv's Debian metadata parser when processing specially...
EulerOS 2.0 SP13 : libsolv (EulerOS-SA-2026-2976)
According to the versions of the libsolv packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect length handlin...
PT-2026-68613
Name of the Vulnerable Software and Affected Versions Scripta eScriptorium versions prior to 26.04.2 Description An issue exists in the handling of METS and IIIF import URIs that allows a remote authenticated user to induce the server to send arbitrary HTTP requests to internal hosts, including...
EulerOS 2.0 SP13 : libsolv (EulerOS-SA-2026-3026)
According to the versions of the libsolv packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect length handlin...
PT-2026-68754
Name of the Vulnerable Software and Affected Versions Ground Station versions prior to 0.6.0 Description An unauthenticated blind server-side request forgery SSRF exists in the orbital-source configuration path. This allows an unauthenticated Socket.IO client to force the process to issue outboun...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the uri.Open and migration asset download paths in modules/uri/uri.go and services/migrations/dump.go. An attacker can make the server fetch internal services, cloud metadata, or local files by...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the uri.Open and migration asset download paths in modules/uri/uri.go and services/migrations/dump.go. An attacker can make the server fetch internal services, cloud metadata, or local files by...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the uri.Open and migration asset download paths in modules/uri/uri.go and services/migrations/dump.go. An attacker can make the server fetch internal services, cloud metadata, or local files by...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the uri.Open and migration asset download paths in modules/uri/uri.go and services/migrations/dump.go. An attacker can make the server fetch internal services, cloud metadata, or local files by...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the uri.Open and migration asset download paths in modules/uri/uri.go and services/migrations/dump.go. An attacker can make the server fetch internal services, cloud metadata, or local files by...
CVE-2026-34966
Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply...
CVE-2026-34966
Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply...
GHSA-945V-V9P3-V5XW rclone local `--metadata` applies attacker-controlled mode/uid - setuid binary planted from an untrusted remote
Summary When writing an object with metadata, the local backend applies the source-supplied mode, uid, and gid verbatim: it parses mode as an octal integer and passes it straight into os.Chmodo.path, os.FileModeumode, and passes uid/gid straight into os.Chown. The value is never masked to...