979456 matches found
BIT-GOLANG-2026-39822 Root escape via symlink plus trailing slash in os
On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symbolic link pointing...
CVE-2026-59203 Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service
Pillow is a Python imaging library. From 12.0.0 through 12.2.0, Pillow's EPS parser in PIL/EpsImagePlugin.py accepts a negative byte count in the %%BeginBinary directive, allowing a crafted EPS file to cause Image.open to seek backwards to the same directive and parse it repeatedly in an infinite...
CVE-2026-59203
Pillow (Python imaging library) 12.0.0–12.2.0 is affected by an issue in the EPS parser (PIL/EpsImagePlugin.py) where a negative byte count in the %%BeginBinary directive allows an EPS file to cause Image.open() to seek backwards to the same directive and repeatedly parse it, creating an infinite...
CVE-2026-14902
An open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary external URLs...
CVE-2026-14902
An open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary external URLs...
CVE-2026-14902
Ivanti Xtraction has an open redirect vulnerability (CVE-2026-14902) in versions before 2026.2.1. An unauthenticated, remote attacker can redirect users to arbitrary external URLs. CVSS v3.1 base score 4.0 (Medium). Remediation: upgrade to 2026.2.1. See Ivanti advisory: https://hub.ivanti.com/s/a...
CVE-2026-14902
An open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary external URLs...
CVE-2026-14902
An open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary external URLs...
EUVD-2026-43682
An open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary external URLs...
SQL Server ODBC driver Elevation of Privilege Vulnerability
Heap-based buffer overflow in SQL Server ODBC driver allows an unauthorized attacker to execute code over a network...
SUSE-SU-2026:2982-1 Security update for python-WebOb
This update for python-WebOb fixes the following issue - CVE-2026-44889: Location header normalization during redirect leads to open redirect bsc1268324...
SUSE-SU-2026:2968-1 Security update for python-Authlib
This update for python-Authlib fixes the following issues - CVE-2026-41425: Prior to 1.6.11, there is no CSRF protection on the cache feature in authlib.integrations.starletteclient.OAuth bsc1263114. - CVE-2026-44681: Prior to 1.6.12 and 1.7.1, an unauthenticated open redirect in Authlib's...
Security Advisory Ivanti Xtraction (CVE-2026-14902, CVE-2026-14903)
Update 18th July: Updated patch available to address functionality impact Ivanti has released updates for Ivanti Xtraction which addresses one medium and one high vulnerability. We are not aware of any customers being exploited by these vulnerabilities at the time of disclosure. Vulnerability...
python-pillow: Pillow: Denial of Service via crafted GD 2.x image file
A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing a specially crafted GD 2.x image file. The GdImageFile.open function reads image dimensions without proper validation, leading to excessive memory allocation. This can result in a...
Denial of Service (DoS)
Overview Affected versions of this package are vulnerable to Denial of Service DoS due to improper timeout management during network read operations in the receive loop. An attacker can cause the application to become unresponsive or crash by sending specially crafted network packets. Details...
EUVD-2026-43603
EIPStackGroup OpENer 2.3.0 commit 76b95cf has an out-of-bounds read issue in Connection Manager handling of ForwardOpen requests when processing short malformed packets. An attacker can send a valid ENIP outer frame carrying a malformed CIP ForwardOpen/LargeForwardOpen request, causing the parser...
CVE-2026-44745
Technical details are not publicly available in the provided documents. Monitor for updates on CVE-2026-44745 for potential details on affected versions, remediation, and impact.
PT-2026-58925
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1 and 8.6.82, deeply nested $or, $and, and $nor query condition operators in the REST API or LiveQuery query handling could trigger exponential-time processing in the internal...
PT-2026-58025
An open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary external URLs...
PT-2026-58909
On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symbolic link pointing...