116873 matches found
CVE-2026-12351
IBM MQ versions 9.3.0.0–9.3.0.41 LTS, 9.3.0.0–9.3.5.1 CD, 9.4.0.0–9.4.0.25 LTS, 9.4.0.0–9.4.5.1 LTS, and 10.0.0.0 are vulnerable to unauthenticated remote code execution via JNDI injection in the Jakarta Resource Adapter IVT servlet . The root cause is unsafe JNDI lookup processing (CWE-74). When...
EUVD-2026-78876
IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources...
CVE-2026-12358 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access
IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources...
CVE-2026-12751 Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.
IBM Cloud Pak for Business Automation is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...
CVE-2026-12751
IBM Cloud Pak for Business Automation is vulnerable to HTML injection , allowing a remote attacker with low privileges to inject malicious HTML that executes in the victim's browser within the security context of the hosting site. The CVSS 3.1 score is 5.4 (Medium) with a changed scope and low im...
CVE-2026-12751 Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.
IBM Cloud Pak for Business Automation is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...
CVE-2026-91986
A flaw was found in gix-transport. This vulnerability allows a remote attacker to inject control characters, specifically NUL, Carriage Return CR, and Line Feed LF bytes, into git-daemon connect requests by crafting malicious git URLs. This injection can lead to spoofing of virtual hosts or the...
CVE-2026-91990
A flaw was found in Tornado. This memory amplification vulnerability exists in the parsemultipartformdata function, where multipart data is processed before validating the maximum number of parts. A remote attacker can exploit this by sending specially crafted multipart requests with numerous...
USN-8768-1: Shibboleth vulnerability
Florian Stuhlmann discovered that Shibboleth incorrectly escaped input when using the ODBC storage plugin. A remote attacker could possibly use this issue to perform SQL injection attacks and obtain sensitive information...
CVE-2026-45765
A flaw was found in Suricata. DNP3 reassembly could buffer data without sufficient parser-level bounds. A remote attacker sending crafted DNP3 traffic may cause Suricata to consume excessive memory, potentially resulting in a denial of service. Mitigation Disable DNP3 parsing in the Suricata...
python: Python unicodedata: Denial of Service due to excessive CPU consumption
A flaw was found in the unicodedata.normalize function in Python. This vulnerability allows a remote attacker to cause excessive CPU consumption by providing specially crafted Unicode input. Successful exploitation can lead to a Denial of Service DoS on the affected system...
mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...
encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue
A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...
mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...
CVE-2026-88616
An issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to achieve arbitrary code execution . The vulnerability exists within the FlwTaskController.java component and is triggered through several specific components and endpoints: FlwTaskServiceImpl.completeTask , CompleteExecuteComponent.proce...
EUVD-2026-78626
An issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to execute arbitrary code via the FlwTaskController.java component, and the FlwTaskServiceImpl.completeTask, CompleteExecuteComponent.process, Warm-Flow TaskService.skip, POST /workflow/task/completeTask components...
CVE-2026-79409
An issue in Webkul Bagisto version 2.4.9 allows a remote attacker to obtain sensitive information. The vulnerability stems from an authorization bypass through a user-controlled key , specifically involving cross-product downloadable entitlement grants via unvalidated links[] parameters. This aff...
ROS-20260915-73-0189
The vulnerability in Chromium is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...