43799 matches found
CVE-2026-69150
KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. Prior to 2.8.0-beta1, KeePass1 / KDB legacy import retains raw Entry pointers in mentryUuids after deleting metastream entries. When a crafted, unlockable .kdb file contains an earlier metastream...
CVE-2026-102734
asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the default Interpreter with numpy enabled exposes a ctypes type and permits fromaddress memory access. safegetattr blocks the ctypes module but not reachable ctypes type objects,...
CVE-2026-74939-escape-the-mac-n-cheese-box
CVE-2026-74939 — Firefox content→parent privilege escalation Proof of concept for a sandbox escape in Firefox 149.0a1 nightly 2fbc0748c4, pre-fix. A compromised content process forges an IPDL message that makes the parent load a page into a privileged privilegedabout process. This is the stage-2...
EUVD-2026-98810
KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. Prior to 2.8.0-beta1, KeePass1 / KDB legacy import retains raw Entry pointers in mentryUuids after deleting metastream entries. When a crafted, unlockable .kdb file contains an earlier metastream...
CVE-2026-69150
KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. Prior to 2.8.0-beta1, KeePass1 / KDB legacy import retains raw Entry pointers in mentryUuids after deleting metastream entries. When a crafted, unlockable .kdb file contains an earlier metastream...
CVE-2026-69150 KeePassXC: Heap use-after-free in KeePass1 (KDB) importer via unpruned m_entryUuids map
KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. Prior to 2.8.0-beta1, KeePass1 / KDB legacy import retains raw Entry pointers in mentryUuids after deleting metastream entries. When a crafted, unlockable .kdb file contains an earlier metastream...
CVE-2026-69150 KeePassXC: Heap use-after-free in KeePass1 (KDB) importer via unpruned m_entryUuids map
KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. Prior to 2.8.0-beta1, KeePass1 / KDB legacy import retains raw Entry pointers in mentryUuids after deleting metastream entries. When a crafted, unlockable .kdb file contains an earlier metastream...
CVE-2026-69150
KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. Prior to 2.8.0-beta1, KeePass1 / KDB legacy import retains raw Entry pointers in mentryUuids after deleting metastream entries. When a crafted, unlockable .kdb file contains an earlier metastream...
CVE-2026-69150
The KeePassXC cross-platform password manager is vulnerable to a heap use-after-free flaw in the KeePass1 / KDB legacy importer prior to version 2.8.0-beta1 . The root cause is the retention of raw Entry pointers in the m_entryUuids map after metastream entries are deleted. A crafted, unlockable ...
CVE-2026-106108 Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory
Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 3.1.0 until 3.3.0, @quasar/app-vite SSG page definitions returned by getSsgPages could supply dir and filename values that were joined to build.distDir without verifying the final destination. Parent...
EUVD-2026-98736
Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 3.1.0 until 3.3.0, @quasar/app-vite SSG page definitions returned by getSsgPages could supply dir and filename values that were joined to build.distDir without verifying the final destination. Parent...
CVE-2026-106108
The Quasar Framework (specifically @quasar/app-vite ) versions 3.1.0 through 3.3.0 are vulnerable to a path traversal issue during SSG builds. The getSsgPages() function fails to verify that dir and filename values remain within the build.distDir, allowing for the creation of files or directories...
CVE-2026-77375
The open-source file transfer solution SFTPGo is vulnerable to a Denial of Service (DoS) condition in versions prior to 2.7.5 . An authenticated SSH user can trigger an unhandled error by sending a malformed protocol message while opening a channel. This flaw causes the server process to terminat...
CVE-2026-36130
PoC Add the folder to lock Before reboot, the Defender process is still running After reboot, the Defender process MsMpEng.exe is gone...
CVE-2026-65200 Huawei malicious on-bus PLDM or NCSI device can drive out-of-bounds-heap reads via short MCTP responses
The openUBMC device-management process parses PLDM-over-MCTP and NCSI-over-MCTP responses from on-bus devices, and three response parsers in the shared transport libraries subtract a fixed header or reserved-field size from a device-supplied response length without a lower-bound check. An...
DEBIAN-CVE-2026-109945
FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smartcard emulation when SCARDIOCTLDISCONNECT and SCARDIOCTLTRANSMIT operate concurrently on one card handle. A malicious RDP server can overlap these IRPs through separate context workers to free and reuse the SCardHandl...
mcpshield
mcpshield A drop-in fix for the unpatched MCP STDIO command-injection flaw the CVE-2026-30623 family, disclosed by OX Security in April 2026 as "by design" -- no SDK patch is coming. Import one line, and every stdio MCP server your Python app launches gets its command/args/env validated before th...
CVE-2026-90094
A flaw was found in the Linux kernel, affecting the arm64 architecture's process context switching. When a user enables the Memory Tagging Extension MTE store-only tag check mode, the associated security setting SCTLREL1.TCSO0 is not properly reset during a task switch. This oversight allows the...
DEBIAN-CVE-2026-109709
Information disclosure, privilege escalation in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...