impacket

Impacket Copyright Fortra, LLC and its affiliated companies. All rights reserved. Impacket was originally created by SecureAuth, and now maintained by Fortra's Core Security. Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level...

CVE-2026-118649

The n8n workflow automation tool is vulnerable to an authorization bypass in versions before 2.43.5 and 2.44.x before 2.44.1 . The application accepts a client-supplied workflow ID to cache the owner project in memory; providing a crafted ID like __proto__ causes the Data Table project check to m...

GHSA-J2W7-387V-M2RQ PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)

Summary When PhpSpreadsheet loads an OpenDocument Spreadsheet .ods, Ods::processTableRow reads the table:number-rows-repeated attribute of a with an unchecked int cast, then materialises one cell per repeated row. This value is completely unbounded, so a single 1.4 KB file can instruct the reader...

EUVD-2026-108267

PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion DoS...

PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)

Summary When PhpSpreadsheet loads an OpenDocument Spreadsheet .ods, Ods::processTableRow reads the table:number-rows-repeated attribute of a with an unchecked int cast, then materialises one cell per repeated row. This value is completely unbounded, so a single 1.4 KB file can instruct the reader...

Allocation of Resources Without Limits or Throttling

Overview phpoffice/phpspreadsheet is a Spreadsheet engine that Read, Create and Write Spreadsheet documents in PHP . Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the ODS file reader in src/PhpSpreadsheet/Reader/Ods.php, where the...

CVE-2026-108359

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Ods::processTableRow in src/PhpSpreadsheet/Reader/Ods.php accepts an unbounded table:number-rows-repeated attribute from an ODS table row. When the row contains a...

CVE-2026-108359 PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Ods::processTableRow in src/PhpSpreadsheet/Reader/Ods.php accepts an unbounded table:number-rows-repeated attribute from an ODS table row. When the row contains a...

CVE-2026-108359 PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Ods::processTableRow in src/PhpSpreadsheet/Reader/Ods.php accepts an unbounded table:number-rows-repeated attribute from an ODS table row. When the row contains a...

CVE-2026-108359

The PhpSpreadsheet PHP library (prior to versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0 ) is vulnerable to a Denial of Service (DoS) attack via the ODS reader. The root cause is located in Ods::processTableRow within src/PhpSpreadsheet/Reader/Ods.php, where the component accepts an unbounded ...

PT-2026-121481

Name of the Vulnerable Software and Affected Versions PhpSpreadsheet versions prior to 1.30.7 PhpSpreadsheet versions prior to 2.1.19 PhpSpreadsheet versions prior to 2.4.8 PhpSpreadsheet versions prior to 3.10.8 PhpSpreadsheet versions prior to 5.10.0 Description The Ods::processTableRow functio...

PT-2026-118432

gx multi line text view display info get reads one byte past the end of the application's text buffer when the string it is given ends with a carriage return r. The over-read can also cause callers to advance their index past the end of the string, producing a second over-read in gx multi line te...

CVE-2026-112294

FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. Any registered user can send requests to /ucenter/action/modelCode/id/counter ...

CVE-2026-112294

The FlyCms application (through commit edfdf724 ) contains a missing authorization vulnerability within the ActionService.counter() method. The root cause is that the checkRowOwner function fails to verify ownership, allowing authenticated users to modify content rows belonging to other users. Sp...

CVE-2026-112294 FlyCms through commit edfdf724 Missing Authorization via Action Counter Endpoint

FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. Any registered user can send requests to /ucenter/action/modelCode/id/counter ...

EUVD-2026-104279

FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. Any registered user can send requests to /ucenter/action/modelCode/id/counter ...

CVE-2026-112294 FlyCms through commit edfdf724 Missing Authorization via Action Counter Endpoint

FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. Any registered user can send requests to /ucenter/action/modelCode/id/counter ...

CVE-2026-112294 FlyCms through commit edfdf724 Missing Authorization via Action Counter Endpoint

FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. Any registered user can send requests to /ucenter/action/modelCode/id/counter ...

PT-2026-117438

FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. Any registered user can send requests to /ucenter/action/modelCode/id/counter ...

CVE-2026-112294: Authorization Bypass Through User-Controlled Key

FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. Any registered user can send requests to /ucenter/action/modelCode/id/counter ...