145570 matches found
fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation}
...
An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934). This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.
...
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**.
...
A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.
...
A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.
...
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
...
Quadratic Behavior in xml.etree.ElementPath Index Predicates
...
Denial of service via exponential certificate policy tree growth in path validation
...
TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication
...
Stack overflow in phar with circular symlinks
...
SQL injection in ext-pgsql via E'...' backslash breakout
...
EUVD-2026-54313
Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate privileges over a network...
EUVD-2026-54325
Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elevate privileges over a network...
EUVD-2026-54322
Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network...
EUVD-2026-54312
Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over a network...
EUVD-2026-54316
Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network...
EUVD-2026-54326
Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-70332
Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network...