562588 matches found
CVE-2026-77151 lin-snow Ech0 crypto.go MD5Encrypt risky encryption
A security flaw has been discovered in lin-snow Ech0 up to 5.4.1. Affected by this issue is the function MD5Encrypt of the file internal/util/crypto/crypto.go. Performing a manipulation results in risky cryptographic algorithm. Remote exploitation of the attack is possible. The complexity of an...
CVE-2025-12135
WPBookit getparam'csscode'; $jscode= $request-getparam'jscode'; updateoption 'wpbcustomcodedata', 'csscode' = $csscode, 'jscode' = $jscode ; Codeausführung aus /core/shortcodes/cla...
Exploit for Missing Authentication for Critical Function in Coreweave Marimo
CVE-2026-39987.py This python script exploit the vulnerable ma...
CVE-2026-77148
A vulnerability was found in Comfast CF-N1-S 2.6.0.1. This impacts the function sub44B50C of the file /cgi-bin/mbox-config?method=SET§ion=ptestchannel of the component Web Management. The manipulation results in stack-based buffer overflow. The attack can be launched remotely. The exploit has...
DEBIAN-CVE-2026-72854
msgpackunpackerexpandbuffer in src/unpack.c, reached through the public msgpackunpackerreservebuffer API, computes its new buffer size using an unchecked sizet addition of the requested size and the amount already used. The doubling loop guards its own multiplication against overflow, but the...
CVE-2026-72854
msgpackunpackerexpandbuffer in src/unpack.c, reached through the public msgpackunpackerreservebuffer API, computes its new buffer size using an unchecked sizet addition of the requested size and the amount already used. The doubling loop guards its own multiplication against overflow, but the...
crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
A flaw was found in the crypto/x509 package of golang. This vulnerability allows a remote attacker to cause a Denial of Service DoS by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name SAN entries. The certificate verification process, specifical...
net/mail: golang: net/mail: Denial of Service via pathological email address parsing
A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...
net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...
Security Bulletin: Security Vulnerabilities affect IBM Voice Gateway
Summary Security Vulnerabilities affect IBM Voice Gateway. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplicatio...
python: Python: Denial of Service via super-linear regular expression work in csv.Sniffer.sniff()
A flaw was found in the csv.Sniffer.sniff function within Python. An attacker can exploit this by providing specially crafted CSV samples, which can trigger super-linear regular-expression processing during dialect sniffing. This excessive processing consumes significant CPU resources, potentiall...
python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module
A flaw was found in Python's http.cookies module. The Morsel.jsoutput function, responsible for generating JavaScript output for cookies, does not properly neutralize the HTML sequence. This oversight could allow a remote attacker to inject malicious script into a web page, potentially leading to...
python: Python pkgutil.get_data(): Path Traversal via improper resource argument validation
A flaw was found in Python's pkgutil.getdata function, which is used to retrieve data from packages. This function did not properly validate the resource argument, allowing a local attacker to perform path traversal attacks. Path traversal enables an attacker to access files and directories store...
GHSA-MPMW-F6H6-3G26 Winter: My Account preview exposes another backend user's profile by record ID
Impact Backend\Controllers\MyAccount, introduced in v1.2.13, declares an empty $requiredPermissions array so that any authenticated backend user can manage their own account. It implements the FormController behavior, which exposes three routable actions — create, update and preview — that each...
Winter: My Account preview exposes another backend user's profile by record ID
Impact Backend\Controllers\MyAccount, introduced in v1.2.13, declares an empty $requiredPermissions array so that any authenticated backend user can manage their own account. It implements the FormController behavior, which exposes three routable actions — create, update and preview — that each...
NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution
Executive Summary Two vulnerabilities were identified and chained to achieve authenticated remote code execution The first vulnerability allows any authenticated admin to redirect the file upload storage root to an arbitrary path on disk including the application directory itself by supplying an...
GHSA-GHVF-QF6H-G8X5 NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution
Executive Summary Two vulnerabilities were identified and chained to achieve authenticated remote code execution The first vulnerability allows any authenticated admin to redirect the file upload storage root to an arbitrary path on disk including the application directory itself by supplying an...
GHSA-8HW4-7QJR-3WXG Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk
Summary SingleBase64Image::uploadFiles — the uploader bound to image-typed fields via withFiles — only verifies that the submitted value starts with the string data:image. The MIME subtype and the base64-decoded bytes are never inspected or validated. A related bug in FileNameGenerator causes the...
Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk
Summary SingleBase64Image::uploadFiles — the uploader bound to image-typed fields via withFiles — only verifies that the submitted value starts with the string data:image. The MIME subtype and the base64-decoded bytes are never inspected or validated. A related bug in FileNameGenerator causes the...
GHSA-XPV2-HRFC-HW62 Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment
Summary The MyAccountController::postAccountInfoForm action bound to POST /admin/edit-account-info calls $this-guard-user-update$request-except'token'. Because the controller uses except'token' rather than $request-validated or the restricted keys defined in AccountInfoRequest::validationData, an...