24865 matches found
CVE-2026-72857 Budibase before 3.40.0 Credential Exposure via STRING Fields
Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource configurations through the read API to...
CVE-2026-72857 Budibase before 3.40.0 Credential Exposure via STRING Fields
Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource configurations through the read API to...
CVE-2026-56755
Denial of Service CPU & Memory Exhaustion via ON^2 String Concatenation in Debian Package Upload...
CVE-2026-56755 Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload
Denial of Service CPU & Memory Exhaustion via ON^2 String Concatenation in Debian Package Upload...
CVE-2026-56755 Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload
Denial of Service CPU & Memory Exhaustion via ON^2 String Concatenation in Debian Package Upload...
CVE-2026-56755 Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload
Denial of Service CPU & Memory Exhaustion via ON^2 String Concatenation in Debian Package Upload...
EUVD-2026-58146
Denial of Service CPU & Memory Exhaustion via ON^2 String Concatenation in Debian Package Upload...
CVE-2026-56755
Denial of Service CPU & Memory Exhaustion via ON^2 String Concatenation in Debian Package Upload...
EUVD-2026-58133
SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in received electronic invoices. When importing a received e-invoice UBL/PEPPOL or an e-commerce export, Zalktis concatenates partner-controlled values directly into SQL statement text using string...
CVE-2026-59109
Summary: CVE-2026-59109 concerns the Zalktis accounting application, where SQL injection can be triggered via trading-partner‑controlled fields in received electronic invoices. What is affected: Zalktis before 2026.1.586 and before 2026.2.592. The issue occurs when importing a received e‑invoice ...
DEBIAN-CVE-2026-67986
amazing-print/amazingprint at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArraygrep. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with a...
JLSEC-2026-1290
There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, including KernelFloat and Stringtof...
CVE-2026-49473
@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. Versions prior to 0.3.0 have an issu...
The vulnerability of the net/mlx5 component in the Linux operating system, which allows a hacker to cause a service failure.
The vulnerability of the net/mlx5 component in the Linux operating system is related to insufficient handling of format strings. Exploiting this vulnerability can allow an attacker to cause a service failure...
PT-2026-80542
Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the get string function in xlstool.c:411...
CVE-2026-52052
mgtlsparsecertder pubkey BIT STRING length underflow -- OOB read...
PT-2026-71703
Name of the Vulnerable Software and Affected Versions Zalktis versions prior to 2026.1.586 Zalktis versions prior to 2026.2.592 Description An issue exists where the application concatenates partner-controlled values directly into SQL statement text during the import of received electronic invoic...
CVE-2026-49473: Interpretation Conflict
@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. Versions prior to 0.3.0 have an issu...
CVE-2026-67986: Improper Control of Generation of Code
amazing-print/amazingprint at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArraygrep. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with a...