305044 matches found
CVE-2026-39909
llama.cpp before b8585 contains a use-after-free vulnerability in the RPC server's GRAPHRECOMPUTE handler that allows unauthenticated remote attackers to achieve arbitrary read and write access by storing a computation graph, freeing referenced buffers, and reclaiming freed memory with...
CVE-2026-39909 llama.cpp Use-After-Free in RPC GRAPH_RECOMPUTE Handler
llama.cpp before b8585 contains a use-after-free vulnerability in the RPC server's GRAPHRECOMPUTE handler that allows unauthenticated remote attackers to achieve arbitrary read and write access by storing a computation graph, freeing referenced buffers, and reclaiming freed memory with...
CVE-2026-69502
Server-side request forgery ssrf in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-54789
modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of...
CVE-2026-54789
mod_auth_openidc (Apache 2.x OpenID Connect Relying Party module) prior to 2.4.19.4 contains an out-of-bounds read and one-byte out-of-bounds write in oidc_state_cookies_parse_token() (src/state.c). The loop scanning for = in a cookie token does not stop at the string terminator, and the cookie !...
EUVD-2026-63999
OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege attackers to access internal network services by submitting arbitrary URLs to the resources API endpoint. Attackers can POST a crafted URL to /api/v1/resources, causing the server ...
CVE-2026-69502
CVE-2026-69502 is a server-side request forgery (SSRF) vulnerability in Azure SQL Database that allows an unauthorized, network-based attacker to elevate privileges . The CNA-assigned CVSS 3.1 score is 10.0 (Critical) with a vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N, indicating no privileges ...
CVE-2026-48769
Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image server returns a crafted Incus-Image-Hash header. This can lead to arbitrary command execution as root on the server. Version 7.2.0 patches th...
EUVD-2026-63983
Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image server returns a crafted Incus-Image-Hash header. This can lead to arbitrary command execution as root on the server. Version 7.2.0 patches th...
CVE-2026-48769
CVE-2026-48769 is a critical (CVSS 9.9) arbitrary file write vulnerability in Incus , a system container and virtual machine manager, affecting versions prior to 7.2.0 . The root cause is that the Incus client trusts a crafted Incus-Image-Hash header returned by a malicious image server, leading ...
CVE-2026-48769 Incus has an arbitrary file write on its client due to trusted image hash
Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image server returns a crafted Incus-Image-Hash header. This can lead to arbitrary command execution as root on the server. Version 7.2.0 patches th...
CVE-2026-68554
A flaw was found in Coturn, a free open source implementation of TURN and STUN Session Traversal Utilities for NAT Server. An on-path attacker can exploit this vulnerability on plain UDP or TCP by appending attributes after the MESSAGE-INTEGRITY field in an authenticated STUN request. This allows...
CVE-2026-59654
Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration functionality. It affects different modules and plugins of the CloudStack management server, including Quota, Host-HA, etc., and may lead to eventual denial of service DoS scenari...
ROOT-APP-NPM-CVE-2026-6402 CVE-2026-6402 in webpack-dev-server - Patched by Root
Root has patched CVE-2026-6402 in the webpack-dev-server package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2025-30359 CVE-2025-30359 in webpack-dev-server - Patched by Root
Root has patched CVE-2025-30359 in the webpack-dev-server package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-9595 CVE-2026-9595 in webpack-dev-server - Patched by Root
Root has patched CVE-2026-9595 in the webpack-dev-server package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2025-30360 CVE-2025-30360 in webpack-dev-server - Patched by Root
Root has patched CVE-2025-30360 in the webpack-dev-server package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-14620 CVE-2026-14620 in webpack-dev-server - Patched by Root
Root has patched CVE-2026-14620 in the webpack-dev-server package for Root:npm. Multiple fixed versions available...
CVE-2026-59654
Apache CloudStack's scoped global configuration functionality suffers from a resource leak (database connections not released after their effective lifetime), affecting modules such as Quota and Host-HA on the management server. Over time, the accumulated leak can lead to an eventual denial of se...