12940 matches found
CVE-2026-68077
An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial of service. This issue affects Apache Qpid Broker-J: through 10.0.1. Users are recommended to upgrade to version 10.1.0, which fixes the...
EUVD-2026-53197
imagecli's scale pipeline operation Scale::apply in src/imageops.rs computes output width/height as dimension as f32 ratio as u32 with no upper-bound validation on the CLI-supplied ratio, which is parsed via nom::number::complete::float with no range check. A large ratio e.g. 100000 causes an...
CVE-2026-67554
The Apache Qpid Proton-Dotnet library (versions through 1.0.0 ) is vulnerable to a Denial of Service (DoS) condition. An authenticated attacker can exploit naive range handling by crafting a disposition frame containing large or illegal ranges, which triggers excessive CPU usage . To remediate th...
CVE-2026-67554 Apache Qpid Proton Dotnet: Unbounded disposition range handling can lead to denial of service
An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial of service. This issue affects Apache Qpid Proton-Dotnet: through 1.0.0. Users are recommended to upgrade to version 1.1.0, which fixes t...
CVE-2026-68077 Apache Qpid Broker-J: Unbounded disposition range handling can lead to denial of service
An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial of service. This issue affects Apache Qpid Broker-J: through 10.0.1. Users are recommended to upgrade to version 10.1.0, which fixes the...
CVE-2026-68077: Unchecked Input for Loop Condition
An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial of service. This issue affects Apache Qpid Broker-J: through 10.0.1. Users are recommended to upgrade to version 10.1.0, which fixes the...
Oracle Linux 9 : kernel (ELSA-2026-49212)
The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-49212 advisory. - net/sched: clsapi: Handle TCACTCONSUMED in tcfqeventhandle CKI Backport Bot RHEL-213299 CVE-2026-64530 - ipc: limit nextid allocation to the valid I...
Oracle Linux 10 : kernel (ELSA-2026-49211)
The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-49211 advisory. - net/sched: clsapi: Handle TCACTCONSUMED in tcfqeventhandle CKI Backport Bot RHEL-214082 CVE-2026-64530 - ksm: use range-walk function to jump over...
Oracle Linux 8 : mingw-glib2 (ELSA-2026-49512)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-49512 advisory. - Fix CVE-2026-58010: off-by-one error in gvstupleisnormal Resolves: RHEL-212164 - Fix CVE-2026-58011: gdatetimeaddfull range validation Resolves:...
NPM: Ghost: Paid gift memberships obtainable at minimal cost via the donations feature
NPM: Ghost: Paid gift memberships obtainable at minimal cost via the donations feature vulnerability discovered by ? in WordPress Npm ghost versions = 6.27.0, 6.44.0...
Ghost: Member existence leak via magic link sign-in response
Impact A discrepancy in responses from the members signin endpoints made it possible for an unauthenticated attacker to determine whether a given email address belongs to a registered member of a Ghost site. Vulnerable versions This vulnerability is present in Ghost from v5.18.0 up to v6.21.0...
CVE-2026-70594 Ghost: Session Fixation in Ghost Admin
Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks. Successful exploitation would have required another vulnerability on the same domain where Ghost Admin was hosted...
NPM: Ghost: Theme Upload Path Traversal
NPM: Ghost: Theme Upload Path Traversal vulnerability discovered by ? in WordPress Npm ghost versions = 0.10.0, 6.54.1...
GHSA-CJC9-Q5GF-327P Ghost: Theme Upload Path Traversal
Impact A vulnerability in custom themes allowed a staff user to write files outside of the uploads directory. This could be used to alter the behavior of the installation. Vulnerable versions This vulnerability is present in Ghost from v0.10.0 up to v6.54.0. Patches v6.54.1 contains a fix for thi...
NPM: Ghost: Server-Side Request Forgery in Image Fetching
NPM: Ghost: Server-Side Request Forgery in Image Fetching vulnerability discovered by ? in WordPress Npm ghost versions = 0.10.0, 6.54.1...
EUVD-2026-39024
Ghost: Server-side request forgery via DNS rebinding in external request handling...
NPM: Ghost: Private IP filtering bypass to make server-side requests to internal services
NPM: Ghost: Private IP filtering bypass to make server-side requests to internal services vulnerability discovered by ? in WordPress Npm ghost versions = 6.0.9, = 6.21.0...
NPM: Ghost: Archived Offers can be Redeemed
NPM: Ghost: Archived Offers can be Redeemed vulnerability discovered by ? in WordPress Npm ghost versions = 4.22.0, 6.54.1...
CVE-2026-70589 Ghost: Archived Offers can be Redeemed
Ghost is a Node.js content management system. From 4.22.0 until 6.54.1, a missing validation check allowed users to redeem subscription offers that were no longer active. This issue is fixed in version 6.54.1...