29 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-79616
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path. CVE-2026-79616 Note that Nessus relies on the presence ...
SUSE CVE-2026-79616
Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path...
CVE-2026-79616
Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path...
DEBIAN-CVE-2026-79616
Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path...
CVE-2026-79616
Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path...
CVE-2026-79616: Out-of-bounds Read
Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path...
NPM: swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies
NPM: swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies vulnerability discovered by ? in WordPress Npm swagger-typescript-api versions = 13.12.1...
GHSA-W284-33MX-6G9V swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies
Summary swagger-typescript-api interpolates OpenAPI path strings the keys of the paths object, e.g. /users/id directly into a JavaScript template literal inside the body of every generated API method, without escaping. A spec path containing $ … survives parseRouteName's x / :x rewriter verbatim...
EUVD-2026-50367
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-routes/schema-routes.ts passes OpenAPI path keys through parseRouteName to templates/default/procedure-call.ejs and templates/modular/procedure-call.ejs without escaping...
CVE-2026-41695 Denial of Service in Spring Data Commons Property Path Resolution
Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution. Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through...
PT-2026-48311
Name of the Vulnerable Software and Affected Versions Spring Data Commons versions 4.0.0 through 4.0.5 Spring Data Commons versions 3.5.0 through 3.5.11 Spring Data Commons versions 3.4.0 through 3.4.14 Description Applications may be subject to denial of service through resource exhaustion. This...
EUVD-2019-7594
Malware in sbrugna...
CVE-2023-26145
This affects versions of the package pydash before 6.0.0. A number of pydash methods such as pydash.objects.invoke and pydash.collections.invokemap accept dotted paths Deep Path Strings to target a nested Python object, relative to the original source object. These paths can be used to target...
CVE-2023-26145: Improper Neutralization of Special Elements used in an OS Command
This affects versions of the package pydash before 6.0.0. A number of pydash methods such as pydash.objects.invoke and pydash.collections.invokemap accept dotted paths Deep Path Strings to target a nested Python object, relative to the original source object. These paths can be used to target...
SUSE CVE-2014-1591
Mozilla Firefox 33.0 and SeaMonkey before 2.31 include path strings in CSP violation reports, which allows remote attackers to obtain sensitive information via a web site that receives a report after a redirect...
macaron: open redirect in the static handler
A flaw was found in macaron. Path URLs aren't cleaned before being redirected creating an open redirect in the static handler...
CVE-2019-17137
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR AC1200 R6220 Firmware version 1.1.0.86 Smart WiFi Router. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of path strings...
Authentication flaw
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR AC1200 R6220 Firmware version 1.1.0.86 Smart WiFi Router. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of path strings...
Information Disclosure
Mozilla Thunderbird is vulnerable to information disclosure. Attackers can use a crafted CSS in an RSS feed that would leak and reveal local path strings, which may contain user name...