149440 matches found
CVE-2026-81632
Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in,...
RLSA-2026:67909 Important: libevent security update
The libevent packages provide an abstract asynchronous event notification library. Security Fixes: libevent: Libevent: Denial of Service via malformed RPC data CVE-2026-63383 libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption CVE-2026-63387...
RLSA-2026:67908 Important: libevent security update
The libevent packages provide an abstract asynchronous event notification library. Security Fixes: libevent: Libevent: Denial of Service via malformed RPC data CVE-2026-63383 libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption CVE-2026-63387...
BIT-MONGODB-2026-82074 Incorrect Authorization in MongoDB Server Aggregation Framework Allows Unauthorized Read Access to Collection Data
MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than what is actually...
Malicious code in koa-request-backend-cors (npm)
Source: amazon-inspector 08921411e6ecc93fa3ef8d34a42907e38e7b700460a3ee414b6b545798b2915c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in karma-repository-request-helmet (npm)
The package karma-repository-request-helmet was found to contain malicious code. --- Credit: OpenSSF source...
Malicious code in jwt-tethys-eleventy-request (npm)
Source: amazon-inspector 566ab5195a913e703f2510e429b5fde782181dae4b9be1302041922eef69bd85 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
CVE-2026-85128 Choose User Role at Registration for WooCommerce < 1.3.3 - Unauthenticated Privilege Escalation via Registration Role Request
The Choose User Role at Registration WordPress plugin before 1.3.3 does not validate the role requested at registration against the roles an administrator chose to offer, allowing unauthenticated users to request any role, including administrator, and to be granted it once the request is approved...
CVE-2026-25281
Transient DOS when processing large or numerous request buffers without sufficient memory allocation validation...
CVE-2026-25281 Allocation of Resources Without Limits or Throttling in OOBM
Transient DOS when processing large or numerous request buffers without sufficient memory allocation validation...
EUVD-2026-81328
Transient DOS when processing large or numerous request buffers without sufficient memory allocation validation...
CVE-2026-25281 Allocation of Resources Without Limits or Throttling in OOBM
Transient DOS when processing large or numerous request buffers without sufficient memory allocation validation...
CVE-2026-25281
CVE-2026-25281 is an Allocation of Resources Without Limits or Throttling vulnerability in Qualcomm OOBM (Out-Of-Band Management). The root cause is insufficient memory allocation validation when processing large or numerous request buffers, leading to a transient denial of service . The CVSS 3.1...
PT-2026-95088
Name of the Vulnerable Software and Affected Versions MitraStar GPT-2741GNAC-N2-SV version BR g8.10 1.11WVK.0b46 Description Authenticated users can execute arbitrary operating system commands through the ping diagnostics and similar functions. This occurs via concatenated parameters sent in a...
PT-2026-94473
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A request buffer leak exists in the asynchronous read path of the SMB client. The function smb2 new read req allocates a request buffer using smb2 plain req init, but fails to release th...
CVE-2026-54918: External Control of System or Configuration Setting
NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. In the affected repository revisions, NETBOXDTLIBRARYURL in tests/testconfiguration.py is a free-form tracked constant that an unauthenticated pull-request author can change before the...
CVE-2026-52483: Improper Neutralization of Special Elements used in an OS Command
The ping diagnostics and other similar functions of the MitraStar GPT-2741GNAC-N2-SV router with firmware BRg8.101.11WVK.0b46 allow authenticated users execute arbitrary OS command via concatenated params on a crafted POST request for the endpoint /cgi-bin/device-management-utilities-internet.cgi...
CVE-2026-90155: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: ksmbd: detach blocked lock requests before freeing A filelock retained by ksmbd for byte-range lock bookkeeping can still be part of the VFS blocked-request graph. In particular, the VFS can chain a new waiter below an already...
CVE-2026-90125: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix request buffer leak in smb2newreadreq smb2newreadreq allocates the request buffer with smb2plainreqinit but only publishes it to the caller with buf = req at the very end of the function. Two error returns sit in...
CVE-2026-85078: Inconsistent Interpretation of HTTP Requests
Sanic is an opensource python web server/framework. In version 25.12.0, Sanic's core HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating zero chunk before reusing the keep-alive connection buffer. A remote unauthenticated client can place attacker-controll...