Flextype CMS 1.0.0-alpha.3 Server-Side Request Forgery

lextype CMS version 1.0.0-alpha.3 contains a server-side request forgery SSRF vulnerability in the expression-processing functionality exposed through the /api/v1/query endpoint. An authenticated remote attacker can supply an arbitrary URL to the exposed fetch function, causing the Flextype serve...

EUVD-2026-71742

Trueview T18161 S 6.0.23.4 contains an improper verification in MQTT command processing. An attacker with network access can replay or modify captured MQTT messages, including security-related nonce, timestamp, and signature fields, and the device accepts the modified messages and executes the...

CVE-2026-80180: Improper Neutralization of Input During Web Page Generation

Stored XSS via markdown HTML processing in Apache Allura. This issue affects Apache Allura: from through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue...

...[ More ]

Flextype CMS version 1.0.0-alpha.3 contains a stored server-side request forgery SSRF vulnerability in its shortcode-processing functionality. Attacker-controlled entry fields can be automatically processed by Flextype's shortcode parser. The built-in fetch shortcode accepts an attacker-controlle...

Flextype CMS 1.0.0-alpha.3 Arbitrary File Read

Flextype CMS version 1.0.0-alpha.3 contains an arbitrary file-read vulnerability in its stored shortcode processing functionality. Attacker-controlled entry fields are automatically processed by the shortcode parser when global shortcode processing is enabled...

The vulnerability of the reg() function in the lib/grammar.js module, a module for defining methods to access and manage XML documents, allows attackers to bypass existing security mechanisms.

The vulnerability of the reg function in the lib/grammar.js module, which is used for accessing and managing XML documents, is related to errors in processing XML requests. Exploiting this vulnerability could allow a malicious actor to bypass existing security mechanisms remotely...

The vulnerability of the Python library for working with PDF files, PyPDF, is related to excessive iteration. This vulnerability allows attackers to trigger a service failure.

The vulnerability of the Python library for working with PDF files, PyPDF, is related to excessive iteration. Exploiting this vulnerability can allow a malicious actor to cause service failures...

CVE-2026-85446

MOOS-IvP versions through 24.8.1 are affected by a quadratic processing vulnerability in the uFldNodeComms component. Each new node identity creates a ledger entry and triggers all-pairs distribution work, allowing a network-based attacker to supply unbounded distinct node names in reports and dr...

CVE-2026-85446 MOOS-IvP through 24.8.1 uFldNodeComms Quadratic Processing Denial of Service

MOOS-IvP versions through 24.8.1 contain a quadratic processing vulnerability in uFldNodeComms where each new node identity creates a ledger entry and triggers all-pairs distribution work. Attackers can supply unbounded distinct node names in reports to drive the shoreside broker into quadratic...

CVE-2026-85446 MOOS-IvP through 24.8.1 uFldNodeComms Quadratic Processing Denial of Service

MOOS-IvP versions through 24.8.1 contain a quadratic processing vulnerability in uFldNodeComms where each new node identity creates a ledger entry and triggers all-pairs distribution work. Attackers can supply unbounded distinct node names in reports to drive the shoreside broker into quadratic...

CVE-2026-85446 MOOS-IvP through 24.8.1 uFldNodeComms Quadratic Processing Denial of Service

MOOS-IvP versions through 24.8.1 contain a quadratic processing vulnerability in uFldNodeComms where each new node identity creates a ledger entry and triggers all-pairs distribution work. Attackers can supply unbounded distinct node names in reports to drive the shoreside broker into quadratic...

CVE-2026-85432

MOOS core-moos through 10.4.0, an underwater robotics middleware, contains a message source spoofing flaw in its MOOSDB message processing layer. The root cause is a failure to validate client identity: the system trusts wire-supplied source identifiers in serialized messages rather than the auth...

libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption

A flaw was found in Libevent, an event notification library. An off-by-one stack buffer overflow exists in the dnsnametolabels function when processing a name-bearing DNS record. A remote attacker could send a specially crafted DNS server response, which may lead to a crash or corruption of the...

CVE-2026-85062

Colord is a tiny yet powerful tool for high-performance color manipulations and conversions. Prior to 2.9.4, synchronous CSS color string matchers in src/colorModels/rgbString.ts, src/colorModels/hslString.ts, src/colorModels/hwbString.ts, src/colorModels/lchString.ts, and...

EmailXpose — Updated!

EmailXpose Specification AI-Powered Email Clarity HTML Mirror: https://roxanneardary.com/emailxpose-specification/ Specification Overview EmailXpose is an open source, modular AI email security and intelligence system designed to analyze email content, sender identity, links, attachments, images,...

EUVD-2026-70645

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing FEATURESECUREPROCESSING and without disabling Java extension functions...

CVE-2026-58400 GeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing FEATURESECUREPROCESSING and without disabling Java extension functions...

CVE-2026-82525

Exterro FTK Imager before 8.3 is affected by an XML External Entity (XXE) injection vulnerability in the processing of Report.xml within UFDR ZIP evidence items. The root cause is the XML parser resolving file:// external entity references and executing msxsl:script within attacker-controlled XSL...

CVE-2026-82525 Exterro FTK Imager < 8.3 XXE via Report.xml XSLT Processing

Exterro FTK Imager before 8.3 contains an XML external entity XXE injection vulnerability that allows attackers to read arbitrary files from the host filesystem by embedding malicious external entity references and attacker-controlled XSLT stylesheets within a Report.xml file inside a UFDR ZIP...

CVE-2026-82525 Exterro FTK Imager < 8.3 XXE via Report.xml XSLT Processing

Exterro FTK Imager before 8.3 contains an XML external entity XXE injection vulnerability that allows attackers to read arbitrary files from the host filesystem by embedding malicious external entity references and attacker-controlled XSLT stylesheets within a Report.xml file inside a UFDR ZIP...