Lucene search
+L

388578 matches found

OSV
OSV
added 2026/08/18 8:47 p.m.5 views

GHSA-43GM-9RR3-CX7G Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover

Summary A stored Cross-Site Scripting XSS vulnerability in Froxlor's DNS editor allows an authenticated user with DNS editor access customer role to inject arbitrary JavaScript into any administrator's browser session. When an administrator views the DNS configuration of an affected domain, the...

8.7CVSS6AI score0.00382EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2026/08/18 8:40 p.m.4 views

CVE-2026-49852

A flaw was found in the joserfc Python library. A remote attacker can exploit a vulnerability in the joserfc.jwt.decode function to forge HMAC-signed tokens. This occurs because the library accepts tokens signed with an empty or null verification key, allowing an attacker to bypass integrity...

8.7CVSS5.4AI score0.00143EPSS
SaveExploits0References6
Github Security Blog
Github Security Blog
added 2026/08/18 8:11 p.m.6 views

resdata has Classic Buffer Overflow, Improper Validation of Array Index, NULL Pointer Dereference and Out-of-bounds Read

Impact Prior to version 6.2.9 resdata would not correctly validate input in GRDECL files. The severity rating assumes that resdata is used to parse untrused files in a networking context such as a webservice. Patches The bug has been patched starting with version 6.2.9...

5.3AI score
SaveExploits0References3Affected Software1
OSV
OSV
added 2026/08/18 8:11 p.m.5 views

GHSA-PR85-W493-9W3X resdata has Classic Buffer Overflow, Improper Validation of Array Index, NULL Pointer Dereference and Out-of-bounds Read

Impact Prior to version 6.2.9 resdata would not correctly validate input in GRDECL files. The severity rating assumes that resdata is used to parse untrused files in a networking context such as a webservice. Patches The bug has been patched starting with version 6.2.9...

9.8CVSS5.4AI score
SaveExploits0References3
RedhatCVE
RedhatCVE
added 2026/08/18 7:17 p.m.3 views

CVE-2026-72283

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine subsystem. This vulnerability occurs when the system fails to update an Interrupt Remapping Table Entry IRTE for a bypass operation, which can leave a pointer to a memory location that has already been freed a 'dangling...

8.8CVSS5.9AI score0.00179EPSS
SaveExploits0References4
OSV
OSV
added 2026/08/18 6:19 p.m.5 views

DEBIAN-CVE-2026-73502

kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/json media type has no schema. In...

5.3CVSS5.2AI score0.00507EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/18 6:19 p.m.4 views

CVE-2026-73502

kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/json media type has no schema. In...

5.3CVSS0.00507EPSS
SaveExploits0References3
SUSE Linux
SUSE Linux
added 2026/08/18 6:14 p.m.6 views

Security update for erlang

This update for erlang fixes the following issues: CVE-2026-28810: predictable DNS transaction IDs can cause DNS cache poisoning bsc1261726. CVE-2026-42789: publickey application accepts non-CA certificates as intermediate issuers and this enables chain forgery bsc1266449. CVE-2026-42790: Name...

9.1CVSS7.6AI score0.0073EPSS
SaveExploits0References76
OSV
OSV
added 2026/08/18 6:14 p.m.2 views

SUSE-SU-2026:3645-1 Security update for erlang

This update for erlang fixes the following issues: - CVE-2026-28810: predictable DNS transaction IDs can cause DNS cache poisoning bsc1261726. - CVE-2026-42789: publickey application accepts non-CA certificates as intermediate issuers and this enables chain forgery bsc1266449. - CVE-2026-42790:...

9.1CVSS6.2AI score0.0073EPSS
SaveExploits0References39
OSV
OSV
added 2026/08/18 5:58 p.m.10 views

CVE-2026-73502 kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema

kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/json media type has no schema. In...

5.3CVSS5.4AI score
SaveExploits0References5
Debian CVE
Debian CVE
added 2026/08/18 5:58 p.m.4 views

CVE-2026-73502

kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/json media type has no schema. In...

5.3CVSS5.3AI score0.00507EPSS
SaveExploits0
EUVD
EUVD
added 2026/08/18 5:58 p.m.9 views

EUVD-2026-61142

kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/json media type has no schema. In...

5.3CVSS5.2AI score0.00507EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/08/18 5:58 p.m.19 views

CVE-2026-73502 kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema

kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/json media type has no schema. In...

5.3CVSS0.00507EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment
added 2026/08/18 5:58 p.m.6 views

CVE-2026-73502 kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema

kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/json media type has no schema. In...

5.3CVSS5.2AI score0.00507EPSS
SaveExploits0References3
CVE
CVE
added 2026/08/18 5:58 p.m.16 views

CVE-2026-73502

In openapi3filter/req_resp_decoder.go (~line 197), defaultContentParameterDecoder dereferences mt.Schema.Value without a nil check, panicking on any spec using a schema-less content parameter. Unauthenticated clients trigger this with one request, causing per-request aborts or full process crashe...

5.3CVSS5.2AI score0.00507EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
added 2026/08/18 5:33 p.m.3 views

CVE-2026-72241

A flaw was found in the kernel. In the leds: uleds module, a buffer overread can occur because the name string provided by userspace is not guaranteed to be null-terminated. This can lead to a local attacker potentially reading sensitive information from adjacent memory or causing a denial of...

5.5CVSS5.6AI score0.0021EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2026/08/18 5:32 p.m.4 views

CVE-2026-72235

A flaw was found in the Linux kernel batman-adv component. The batadvinterfacerx function, responsible for handling network packets, can reallocate its internal buffer. However, a pointer to the ethernet header is not correctly updated after this reallocation. This oversight leads to a...

8.8CVSS5.5AI score0.00339EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2026/08/18 5:32 p.m.4 views

CVE-2026-72234

A flaw was found in the Linux kernel's batman-adv module. When the pskbmaypull function is called by batadvgetvid, it can reallocate a buffer. However, a pointer to the old buffer, specifically unicastpacket, was not correctly reassigned, leading to a use-after-free condition. This memory...

9.8CVSS5.5AI score0.00684EPSS
SaveExploits0References4
OSV
OSV
added 2026/08/18 5:26 p.m.8 views

GHSA-W26R-FWG8-RCP3 MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions

Summary MagicMirror applies ipWhitelist only as Express middleware, but the Socket.IO server is attached directly to the HTTP server without equivalent IP allowlist, origin, or namespace authentication checks. In a documented common deployment where MagicMirror listens on a non-loopback interface...

2.3CVSS6.2AI score0.00279EPSS
SaveExploits0References5
Github Security Blog
Github Security Blog
added 2026/08/18 5:26 p.m.7 views

MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions

Summary MagicMirror applies ipWhitelist only as Express middleware, but the Socket.IO server is attached directly to the HTTP server without equivalent IP allowlist, origin, or namespace authentication checks. In a documented common deployment where MagicMirror listens on a non-loopback interface...

2.3CVSS6.2AI score0.00279EPSS
SaveExploits0References5Affected Software1
Rows per page
Query Builder