1937 matches found
OWASP-Subtractive-Hardening-Top-10 — Updated!
OWASP Subtractive Security Top 10 Project Overview The OWASP Subtractive Security Top 10 Project is an initiative to identify, document, and promote the highest-impact opportunities for reducing cyber risk through the elimination of attack paths. Unlike traditional security guidance that focuses...
PT-2026-69140
Name of the Vulnerable Software and Affected Versions Pathling Server versions prior to 2.0.0 Description Pathling Server contains an authorization bypass in its typed CRUD, search, and batch FHIR surface. Authenticated users with coarse operation authorities can interact with resource families...
CVE-2026-47663: Improper Authorization
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's typed CRUD/search/batch FHIR surface allows an authenticated caller with only coarse operation authorities to act on...
Beyond the Quantum Promise: A Security Analysis of Classical Control in Quantum Key Distribution
Quantum Key Distribution QKD protocols provide information-theoretic security by using quantum mechanical principles. Yet QKD is fundamentally a hybrid protocol: its security depends on the correct integration of the quantum phase with classical post-processing. While ETSI and ITUT specifications...
Canonicalization Failures As a Recurring Vulnerability Class: Representation Divergence in Cryptographic Systems and Its Avoidance
Cryptographic systems operate on bytes but mean semantic objects. The translation between the two is rarely unique. Where this uniqueness is not enforced, an attack surface opens up as soon as a hash, a signature, replay protection, or consensus identity depends on the representation. The same...
MAL-2026-13378 Malicious code in npm-dc-dev (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91248167ea052dfca231e837bd645444f362dc087be9a7c04f1cf4aeec4d6723 package.json declares "postinstall": "node test.js". test.js top-level require'.'s index.js and awaits an exported fromstr. index.js consists of a...
claude-red
claude-red Offe...
gimp: GIMP APNG loader heap-buffer-overflow when fcTL width exceeds IHDR width (file-png.c)
A heap-buffer-overflow vulnerability exists in the APNG Animated PNG file loader of GIMP. This flaw occurs when the fcTL width exceeds the IHDR width, leading to pixel data being written past the end of a heap allocation. Additionally, a heap-based buffer overflow exists in the DDS plug-in due to...
MAL-2026-11548 Malicious code in streak-math-abz (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1eddf7b9d6d5331bdc1c1afe40913620b219afcc06a705aef3fe547ddc5cf25 The package advertises itself as a JavaScript day-math helper but its ESM main entry dist/index.mjs unconditionally spawns a bundled Linux x8664 ELF...
Malicious code in streak-math-abz (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1eddf7b9d6d5331bdc1c1afe40913620b219afcc06a705aef3fe547ddc5cf25 The package advertises itself as a JavaScript day-math helper but its ESM main entry dist/index.mjs unconditionally spawns a bundled Linux x8664 ELF...
CVE-2026-42170
A heap-based buffer overflow vulnerability exists in the GIMP DDS DirectDraw Surface file parser. When a crafted DDS file declares a D3D9 pixel format but sets a lower bits-per-pixel bpp value in the header, the loader allocates an undersized heap buffer. Subsequent pixel data consumption at the...
Important: freerdp
Issue Overview: Heap-buffer-overflow write in AVC444 YUV buffer allocation In libfreerdp/codec/h264.c, avc444ensurebuffer computes the AVC444 YUV444 intermediate buffer size as piDstSizex = piDstStridex padDstHeight using UINT32 arithmetic. When the true product exceeds UINT32MAX, the value wraps...
OWASP Subtractive Security Top 10 Project
The OWASP Subtractive Security Top 10 Project is an initiative to identify, document, and promote the highest-impact opportunities for reducing cyber risk through the elimination of attack paths. Unlike traditional security guidance that focuses primarily on adding controls, the Subtractive...
Joern 4.0.594
Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...
Exodia
Exodia Autonomous AI-driven penetrat...
CVE-2026-9856
A vulnerability in huggingface/transformers versions =5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the savepretrained methods of PreTrainedTokenizerBase and ProcessorMixin, where keys from the chattemplate dictionary are used directly as...
UBUNTU-CVE-2026-67306
FreeRDP versions 3.28.0 and earlier contain an out-of-bounds read vulnerability in the RDP6 planar RLE bitmap decoder functions planardecompressplanerle and planardecompressplanerleonly in libfreerdp/codec/planar.c. Only the 1-byte control byte is bounds-checked; the subsequent 0–15...
CVE-2026-67306 FreeRDP before 3.29.0 Out-of-Bounds Read via Planar RLE
FreeRDP versions 3.28.0 and earlier contain an out-of-bounds read vulnerability in the RDP6 planar RLE bitmap decoder functions planardecompressplanerle and planardecompressplanerleonly in libfreerdp/codec/planar.c. Only the 1-byte control byte is bounds-checked; the subsequent 0–15...
CVE-2026-67306
FreeRDP versions 3.28.0 and earlier contain an out-of-bounds read vulnerability in the RDP6 planar RLE bitmap decoder functions planardecompressplanerle and planardecompressplanerleonly in libfreerdp/codec/planar.c. Only the 1-byte control byte is bounds-checked; the subsequent 0–15...
Chromium: CVE-2026-17905 Inappropriate implementation in SurfaceCapture
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...