CVE-2021-47876: Allocation of Resources Without Limits or Throttling

GeoGebra Classic 5.0.631.0-d contains a denial of service vulnerability in the input field that allows attackers to crash the application by sending oversized buffer content. Attackers can generate a large buffer of 800,000 repeated characters and paste it into the 'Entrada:' input field to trigg...

CVE-2025-66959: Improper Input Validation

An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the GGUF decoder...

Linux Distros Unpatched Vulnerability : CVE-2025-13465

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the .unset and .omit functions. An attacker can pass crafted paths which cause...

Linux Distros Unpatched Vulnerability : CVE-2025-14157

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 6.3 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed...

CVE-2026-24061: Improper Neutralization of Argument Delimiters in a Command

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable...

CVE-2026-0865: Improper Neutralization of Special Elements in Output Used by a Downstream Component

User-controlled header names and values containing newlines can allow injecting HTTP headers...

CVE-2026-0895: Deserialization of Untrusted Data

The extension extends TYPO3’ FileSpool component, which was vulnerable to Insecure Deserialization prior to TYPO3-CORE-SA-2026-004 https://typo3.org/security/advisory/typo3-core-sa-2026-004 . Since the related fix is overwritten by the extension, using the extension with a patched TYPO3 core...

CVE-2025-11743: Improper Validation of Specified Quantity in Input

A denial-of-service security issue in the affected product. The security issue occurs when a malformed CIP forward open message is sent. This could result in a major nonrecoverable fault a restart is required to recover...

CVE-2025-41768: Improper Neutralization of Input During Web Page Generation

An high privileged remote attacker can inject arbitrary content into the custom CSS field on the affected devices due to improper neutralization of input during web page generation 'Cross-site Scripting'...

CVE-2025-14027: Missing Release of Memory after Effective Lifetime

Multiple denial-of-service vulnerabilities exist in the affected product. These issues can be triggered through various crafted inputs, including malformed Class 3 messages, memory leak conditions, and other resource exhaustion scenarios. Exploitation may cause the device to become unresponsive...

CVE-2026-0672: Improper Neutralization of CRLF Sequences

When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters...

CVE-2025-15367: Improper Neutralization of Special Elements used in a Command

The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters...

CVE-2025-11468: Improper Neutralization of CRLF Sequences

When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized...

CVE-2026-23845: Server-Side Request Forgery (SSRF)

Mailpit is an email testing tool and API for developers. Versions prior to 1.28.3 are vulnerable to Server-Side Request Forgery SSRF via HTML Check CSS Download. The HTML Check feature /api/v1/message/ID/html-check is designed to analyze HTML emails for compatibility. During this process, the...

CVE-2025-55249: Protection Mechanism Failure

HCL AION is affected by a Missing Security Response Headers vulnerability. The absence of standard security headers may weaken the application’s overall security posture and increase its susceptibility to common web-based attacks...

CVE-2025-55250: Generation of Error Message Containing Sensitive Information

HCL AION version 2 is affected by a Technical Error Disclosure vulnerability. This can expose sensitive technical details, potentially resulting in information disclosure or aiding further attacks...

Exploit for CVE-2026-22610

Angular SVG Vulnerability Scanner CVE-2026-22610 Purpose...

CVE-2026-0518: Improper Neutralization of Input During Web Page Generation

CVE-2026-0518 is a cross-site scripting vulnerability in versions of Secure Access prior to 14.20. An attacker with administrative privileges can interfere with another administrator’s use of the console...

CVE-2025-68921: Improper Limitation of a Pathname to a Restricted Directory

SteelSeries Nahimic 3 1.10.7 allows Directory traversal...

MiracleLinux 4 : python27-python-2.7.8-18.0.1.AXS4.AXS4 (AXSA:2016-643:01)

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2016-643:01 advisory. Python is an interpreted, interactive, object-oriented programming language often compared to Tcl, Perl, Scheme or Java. Python includes modules, classes,...