90744 matches found
CVE-2026-4147: Use of Uninitialized Variable
An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command...
CVE-2026-1323: Deserialization of Untrusted Data
The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted serialized code. Note that an active exploit requires write access to the directory configured at...
CVE-2026-4208: Authorization Bypass Through User-Controlled Key
The extension fails to properly reset the generated MFA code after successful authentication. This leads to a possible MFA bypass for future login attempts by providing an empty string as MFA code to the extensions MFA provider...
CVE-2026-1267: Exposure of Sensitive Information to an Unauthorized Actor
IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an unauthorized access to sensitive application data and administrative functionalities due to lack of proper access controls...
CVE-2025-62320: Improper Neutralization of Input During Web Page Generation
HTML Injection can be carried out in Product when a web application does not properly check or clean user input before showing it on a webpage. Because of this, an attacker may insert unwanted HTML code into the page. When the browser loads the page, it may automatically interact with external...
Exploit for Race Condition in Canonical Ubuntu_Linux
Dillu-Analyzer 🛡️ Dillu Analyzer — A web-based universal malwa...
CVE-2025-6969: Improper Input Validation
in OpenHarmony v5.1.0 and prior versions allow a local attacker cause DOS through improper input...
CVE-2026-3644: Improper Input Validation
The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update, |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.jsoutput lacked the output validation applie...
CVE-2026-30876: Observable Response Discrepancy
Chamilo LMS is a learning management system. Prior to version 1.11.36, Chamilo is vulnerable to user enumeration with valid/invalid username. This issue has been patched in version 1.11.36...
CVE-2026-32777: Loop with Unreachable Exit Condition
libexpat before 2.7.5 allows an infinite loop while parsing DTD content...
CVE-2026-30405: Uncontrolled Resource Consumption
An issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to cause a denial of service via the NEXTHOP path attribute...
CVE-2026-32630: Improper Handling of Highly Compressed Data (Data Amplification)
file-type detects the file type of a file, stream, or data. From 20.0.0 to 21.3.1, a crafted ZIP file can trigger excessive memory growth during type detection in file-type when using fileTypeFromBuffer, fileTypeFromBlob, or fileTypeFromFile. The ZIP inflate output limit is enforced for...
CVE-2026-4179: Loop with Unreachable Exit Condition
Issues in stm32 USB device driver drivers/usb/device/usbdcstm32.c can lead to an infinite while loop...
CVE-2025-62319: Improper Neutralization of Special Elements used in an SQL Command
Boolean-Based SQL Injection is a type of blind SQL injection where an attacker manipulates SQL queries by injecting Boolean conditions TRUE or FALSE into application input fields. Instead of returning database errors or visible data, the application responds differently depending on whether the...
CVE-2026-3020: Authorization Bypass Through User-Controlled Key
Identity based authorization bypass vulnerability IDOR that allows an attacker to modify the data of a legitimate user account, such as changing the victim's email address, validating the new email address, and requesting a new password. This could allow them to take complete control of other...
CVE-2026-20992: Incorrect Authorization
Improper authorization in Settings prior to SMR Mar-2026 Release 1 allows local attacker to disable configuring the background data usage of application...
CVE-2026-20989: Improper Verification of Cryptographic Signature
Improper verification of cryptographic signature in Font Settings prior to SMR Mar-2026 Release 1 allows physical attackers to use custom font...
CVE-2025-52648: Improper Verification of Cryptographic Signature
HCL AION is affected by a vulnerability where offering images are not digitally signed. Lack of image signing may allow the use of unverified or tampered images, potentially leading to security risks such as integrity compromise or unintended behavior in the system...
CVE-2025-12736: Use of Uninitialized Resource
in OpenHarmony v5.0.3 and prior versions allow a local attacker case sensitive information leak through use of uninitialized resource...