16152 matches found
CVE-2026-66317
Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to perform tampering over a network...
CVE-2026-66317 Microsoft Edge (Chromium-based) Tampering Vulnerability
...
CVE-2026-66311
CVE-2026-66311: Microsoft Edge (Chromium-based) Tampering Vulnerability. Local attacker can tamper due to missing authorization. Affects Edge when running Chromium-based builds; CVSSv3.1 base score 6.2 (Medium), confidentiality impact High, no impact to integrity/availability. Remediation: apply ...
CVE-2026-66311 Microsoft Edge (Chromium-based) Tampering Vulnerability
...
CVE-2026-66311
Missing authorization in Microsoft Edge Chromium-based allows an unauthorized attacker to perform tampering locally...
CVE-2026-66311 Microsoft Edge (Chromium-based) Tampering Vulnerability
...
CVE-2026-66313 Microsoft Edge (Chromium-based) Tampering Vulnerability
...
CVE-2026-66313
Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to perform tampering locally...
CVE-2026-66313
CVE-2026-66313: A origin validation error in Microsoft Edge (Chromium-based) enables local tampering by an unauthorized attacker. Documents confirm the vulnerability exists but provide no specific exploit details or mitigations; no patch/version is stated in the supplied sources. Remediation stat...
CVE-2026-66313 Microsoft Edge (Chromium-based) Tampering Vulnerability
...
GHSA-V8FG-2RW7-Q452 Sequelize: SQL Injection (Oracle DB)
Summary SQL Injection is possible with strings only if dialect is set to oracle. The vulnerability was confirmed on Sequelize v6.37.3. Details The escape function defined in sql-string.js does not escape quotes if the value starts with TOTIMESTAMP or TODATE. javascript else if dialect === 'oracle...
Sequelize: SQL Injection (Oracle DB)
Summary SQL Injection is possible with strings only if dialect is set to oracle. The vulnerability was confirmed on Sequelize v6.37.3. Details The escape function defined in sql-string.js does not escape quotes if the value starts with TOTIMESTAMP or TODATE. javascript else if dialect === 'oracle...
axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth
A flaw was found in axios. This vulnerability involves prototype pollution read-side gadgets within the basic authentication subfield handling. If an application is already susceptible to a separate prototype pollution issue and makes an axios request without specifying username or password in it...
CVE-2026-12259
In nltk version 3.9.4, the nltk.downloader.Downloader.downloadpackage function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for info.url through a compromised...
UBUNTU-CVE-2026-12259
In nltk version 3.9.4, the nltk.downloader.Downloader.downloadpackage function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for info.url through a compromised...
CVE-2026-12259
The CVE affects nltk 3.9.4: nltk.downloader.Downloader._download_package() can write package bytes to disk and may extract them before SHA-256/MD5 checks, enabling tampering via compromised mirrors or proxies. This could lead to installation of attacker-controlled package bytes (potentially malic...
CVE-2026-12259 Improper Input Validation in nltk/nltk
In nltk version 3.9.4, the nltk.downloader.Downloader.downloadpackage function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for info.url through a compromised...
CVE-2026-12259
In nltk version 3.9.4, the nltk.downloader.Downloader.downloadpackage function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for info.url through a compromised...
Improper Validation of Integrity Check Value
Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the getContentStream method of RecipientInformation, which, when authenticated attributes are present, authenticates only the DER-encoded authAttrs and never checks the computed content...
