23746 matches found
Open Babel has out-of-bounds write in MSI translationVectors[]
SummaryA memory-safety vulnerability in Open Babel's MSI parser allowed anout-of-bounds write into the translationVectors array whenreading a crafted input file. DetailsThe MSI reader stored cell translation vectors into a fixed-sizetranslationVectors array. A malformed input could push morevecto...
PYSEC-2026-2544 kas checks out SHA-like git branches as valid commits
Impact When relying solely on a git commit ID SHA-1 or SHA-256 to qualify if a checkout of a repository is equivalent to the state validated while adding its commit ID to a kas configuration, users may be tricked to check out a branch of the same name from this repository. This implies that the...
kedro-datasets has a path traversal vulnerability in PartitionedDataset that allows arbitrary file write
ImpactPartitionedDataset in kedro-datasets was vulnerable to path traversal. Partition IDs were concatenated directly with the dataset base path without validation. An attacker or malicious input containing .. components in a partition ID could cause files to be written outside the configured...
PYSEC-2026-2448 Django vulnerable to Uncontrolled Resource Consumption
An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. URLField.topython in Django calls urllib.parse.urlsplit, which performs NFKC normalization on Windows that is disproportionately slow for certain Unicode characters, allowing a remote attacker to cause denial o...
Django has a Race Condition vulnerability
An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29.Race condition in file-system storage and file-based cache backends in Django allows an attacker to cause file system objects to be created with incorrect permissions via concurrent requests, where one thread's...
pypdf: Manipulated FlateDecode XFA streams can exhaust RAM
ImpactAn attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing the xfa property of a reader or writer and the corresponding stream being compressed using /FlateDecode. PatchesThis has been fixed in pypdf==6.7.3. WorkaroundsIf projects...
wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookup
SummaryThree nutritionalvalues action endpoints fetch objects via Model.objects.getpk=pk — a raw ORM call that bypasses the user-scoped queryset. Any authenticated user can read another user's private nutrition plan data, including caloric intake and full macro breakdown, by supplying an arbitrar...
Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation
Scrapy versions up to 2.13.3 are vulnerable to a denial of service DoS attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of...
TensorFlow vulnerable to `CHECK`-fail in `tensorflow::full_type::SubstituteFromAttrs`
ImpactWhen tensorflow::fulltype::SubstituteFromAttrs receives a FullTypeDef& t that is not exactly three args, it triggers a CHECK-fail instead of returning a status.cppStatus SubstituteForEachAttrMap& attrs, FullTypeDef& t DCHECKEQt.argssize, 3; const auto& cont = t.args0; const auto& tmpl =...
WordPress WP Customer Area plugin <= 8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zaim in WordPress Plugin WP Customer Area versions = 8.3.5...
EUVD-2026-43445
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Hitesh Chandwani reCAPTCHA v2 & v3 for Asgaros Forum recaptcha-for-asgaros-forum allows DOM-Based XSS.This issue affects reCAPTCHA v2 & v3 for Asgaros Forum: from n/a through = 1.1.0...
CVE-2026-57738
creationtimestamp| type| source ---|---|--- 2026-07-13 11:24:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqjldylgvv2h 2026-07-13 11:24:30+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjler6l6c2w 2026-07-13 11:28:13+00:00| seen|...
CVE-2026-57719
creationtimestamp| type| source ---|---|--- 2026-07-13 11:20:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqjl4ur7zb2b 2026-07-13 11:23:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjlchorxn24 2026-07-13 11:29:15+00:00| seen|...
CVE-2026-57726
creationtimestamp| type| source ---|---|--- 2026-07-13 11:18:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjkzjborp27 2026-07-13 11:18:32+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjl23jjqs2w 2026-07-13 11:22:05+00:00| seen|...
CVE-2026-57739
creationtimestamp| type| source ---|---|--- 2026-07-13 11:01:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjk47dll32g 2026-07-13 11:24:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqjle25nl22b 2026-07-13 11:25:20+00:00| seen|...
CVE-2026-57744
creationtimestamp| type| source ---|---|--- 2026-07-13 10:43:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjj3ams7d2e 2026-07-13 11:26:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqjlhle6wj22 2026-07-13 11:28:18+00:00| seen|...
CVE-2026-61971
Authorization Bypass Through User-Controlled Key vulnerability in Cozmoslabs User Profile Picture metronet-profile-picture allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Profile Picture: from n/a through = 2.6.3...
CVE-2026-57771
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Milan Petrovic GD Rating System gd-rating-system allows Blind SQL Injection.This issue affects GD Rating System: from n/a through = 3.7...
CVE-2026-57734
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in tagDiv tagDiv Composer td-composer allows Reflected XSS.This issue affects tagDiv Composer: from n/a through = 5.4.3...