7919 matches found
CVE-2026-21998
Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MyS...
CVE-2026-40907
WWBN AVideo is an open source video platform. In versions 29.0 and prior, the endpoint plugin/Live/view/Liverestreams/list.json.php contains an Insecure Direct Object Reference IDOR vulnerability that allows any authenticated user with streaming permission to retrieve other users' live restream...
CVE-2026-33813
The golang.org/x/image package is vulnerable to a panic when parsing a WEBP image with an invalid, large size on 32-bit platforms . This vulnerability can lead to remote service interruptions . The issue is addressed in golang.org/x/image/webp version v0.39.0 . Affected applications include rclon...
CVE-2026-33813 Panic when decoding large WEBP image on 32-bit platforms in golang.org/x/image
Parsing a WEBP image with an invalid, large size panics on 32-bit platforms...
CVE-2026-33813 Panic when decoding large WEBP image on 32-bit platforms in golang.org/x/image
Parsing a WEBP image with an invalid, large size panics on 32-bit platforms...
PT-2026-34061
WWBN AVideo is an open source video platform. In versions 29.0 and prior, the endpoint plugin/Live/view/Live restreams/list.json.php contains an Insecure Direct Object Reference IDOR vulnerability that allows any authenticated user with streaming permission to retrieve other users' live restream...
GHSA-VR7G-88FQ-VHQ3 Paperclip: OS Command Injection via Execution Workspace cleanupCommand
| Field | Value | |-------|-------| | Affected Software | Paperclip AI v2026.403.0 | | Affected Component | Execution Workspace lifecycle workspace-runtime.ts | | Affected Endpoint | PATCH /api/execution-workspaces/:id | | Deployment Modes | All — localtrusted zero auth, authenticated any company...
CVE-2026-41035
In rsync 3.0.1 through 3.4.1, receivexattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X aka --xattrs. On Linux, many but not all common configurations are vulnerable. Non-Linux platforms are more widely vulnerable...
The vulnerabilities of SAP S/4HANA and SAP ERP software platforms, related to deficiencies in authentication procedures, allow attackers to influence the integrity and accessibility of protected information.
The vulnerabilities of SAP S/4HANA and SAP ERP software platforms are related to deficiencies in authentication procedures. Exploiting these vulnerabilities can allow attackers operating remotely to compromise the integrity and accessibility of protected information...
GHSA-VMWF-M9C5-3JVC Microsoft Security Advisory CVE-2026-32178 – .NET Spoofing Vulnerability
Executive Summary: Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0, .NET 9.0, and .NET 10.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in...
WWBN AVideo has an IDOR in Live Restreams list.json.php Exposes Other Users' Stream Keys and OAuth Tokens
Summary The endpoint plugin/Live/view/Liverestreams/list.json.php contains an Insecure Direct Object Reference IDOR vulnerability that allows any authenticated user with streaming permission to retrieve other users' live restream configurations, including third-party platform stream keys and OAut...
CVE-2026-34622
creationtimestamp| type| source ---|---|--- 2026-04-14 17:33:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjhvywqpah2t 2026-04-14 17:48:00+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjhwtmmgds25 2026-04-14 20:03:36+00:00| published-proof-of-concept|...
JLSEC-2026-91
PAC parsing in MIT Kerberos 5 aka krb5 before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution in KDC, kadmind, or a GSS or Kerberos application server on 32-bit platforms which have a resultant heap-based buffer overflow, and cause a denial of service ...
firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: JIT miscompilation in the JavaScript Engine: JIT component...
CVE-2026-31426: Use After Free
In the Linux kernel, the following vulnerability has been resolved: ACPI: EC: clean up handlers on probe failure in acpiecsetup When ecinstallhandlers returns -EPROBEDEFER on reduced-hardware platforms, it has already started the EC and installed the address space handler with the struct acpiec...
CVE-2026-6139
creationtimestamp| type| source ---|---|--- 2026-04-12 16:16:35+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-6139 2026-04-13 02:00:08+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjdrfrurel2h 2026-04-13 02:48:11+00:00| seen|...
CVE-2026-6112
creationtimestamp| type| source ---|---|--- 2026-04-12 05:16:17+00:00| published-proof-of-concept| Telegram/rbF7fSnY0VEd6aCx4theR2I2I4JGiCz6cyJ3UThbj-lLIU 2026-04-12 05:45:49+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjbnkgiyk52w 2026-04-12 06:35:09+00:00| seen|...
CVE-2026-4149
creationtimestamp| type| source ---|---|--- 2026-04-11 01:30:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116383483774809251 2026-04-11 01:30:32+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mj6osz6g672t 2026-04-11 03:06:41+00:00| seen|...
golang.org/x/image: golang: golang.org/x/image: Denial of Service via malformed WEBP image parsing
A flaw was found in golang.org/x/image. A remote attacker could exploit this vulnerability by providing a specially crafted WEBP image with an invalid, large size. This could cause the application to panic and crash on 32-bit platforms, leading to a Denial of Service DoS...
