22692 matches found
CVE-2026-34588 OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.1.0 to before 3.2.7, 3.3.9, and 3.4.9, internalexrundopiz advances the working wavelet pointer with signed 32-bit arithmetic. Because nx, ny, and...
Security Bulletin: Maximo AI Service uses qs-6.14.1.tgz and flask-3.0.3-py3-none-any.whl which is vulnerable to CVE-2026-2391 and CVE-2026-27205.
Summary Maximo AI Service uses qs-6.14.1.tgz and flask-3.0.3-py3-none-any.whl which is vulnerable to CVE-2026-2391 and CVE-2026-27205. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-2391 DESCRIPTION: Summary The arrayLimit opti...
CVE-2026-5643 Cyber-III Student-Management-System Admin Add Endpoint notice.php cross site scripting
A vulnerability was identified in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This impacts an unknown function of the file /admin/Add%20notice/notice.php of the component Admin Add Endpoint. Such manipulation of the argument $SERVER'PHPSELF' leads to cross...
CVE-2026-5643
The CVE-2026-5643 entry concerns Cyber-III Student-Management-System (up to build 1a938fa61e9f735078e9b291d2e6215b4942af3f) where an attacker can manipulate the argument $_SERVER['PHP_SELF'] in /admin/Add notice/notice.php (Admin Add Endpoint) to trigger cross-site scripting. The vulnerability is...
CVE-2026-5642 Cyber-III Student-Management-System HTTP POST Request update.php improper authorization
A vulnerability was determined in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This affects an unknown function of the file /viva/update.php of the component HTTP POST Request Handler. This manipulation of the argument Name causes improper authorization. It ...
CVE-2026-5642 Cyber-III Student-Management-System HTTP POST Request update.php improper authorization
A vulnerability was determined in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This affects an unknown function of the file /viva/update.php of the component HTTP POST Request Handler. This manipulation of the argument Name causes improper authorization. It ...
CVE-2026-5638
A vulnerability was detected in HerikLyma CPPWebFramework up to 3.1. This issue affects some unknown processing. Performing a manipulation results in path traversal. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem...
CVE-2026-5638 HerikLyma CPPWebFramework path traversal
A vulnerability was detected in HerikLyma CPPWebFramework up to 3.1. This issue affects some unknown processing. Performing a manipulation results in path traversal. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem...
CVE-2026-5633 assafelovic gpt-researcher ws Endpoint server-side request forgery
A vulnerability was determined in assafelovic gpt-researcher up to 3.4.3. Affected is an unknown function of the component ws Endpoint. Executing a manipulation of the argument sourceurls can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been...
CVE-2026-5632 assafelovic gpt-researcher HTTP REST API Endpoint missing authentication
A vulnerability was found in assafelovic gpt-researcher up to 3.4.3. This impacts an unknown function of the component HTTP REST API Endpoint. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit has been made public and could be...
CVE-2026-5630 assafelovic gpt-researcher Report API app.py cross site scripting
A flaw has been found in assafelovic gpt-researcher up to 3.4.3. The impacted element is an unknown function of the file backend/server/app.py of the component Report API. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been...
CVE-2026-5611
creationtimestamp| type| source ---|---|--- 2026-04-06 04:00:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3misevgz2sn2t 2026-04-06 05:16:26+00:00| published-proof-of-concept| Telegram/kWexhLh74l4dPPtnd5KMBhXNW8mWfIV9fawO6hseg4Rc4 2026-04-06 05:20:04+00:00| seen|...
CLEANSTART-2026-NB78893 Security fixes for CVE-2025-47911, CVE-2025-58190, CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-64715, CVE-2025-68119, CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, CVE-2026-33186, CVE-2026-33726 applied in versions: 0.13.3-r0, 0.13.3-r1
Multiple security vulnerabilities affect the hubble-ui-fips package. These issues are resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-LR09759 Security fixes for ghsa-72hv-8253-57qq applied in versions: 3.6.4-r4
Security vulnerability affects the apache-zookeeper package. This issue is resolved in later releases. See references for vulnerability details...
GHSA-H2JQ-G4CQ-5PPQ vulnerabilities
Vulnerabilities for packages: ruby3.4-rack, ruby3.3-rack, gitlab-rails-ce, kube-fluentd-operator, pact-broker-docker-fips, pact-broker-docker, ruby3.4-rails, ruby3.2-rails, logstash, gitlab-cng, ruby4.0-rack, gitlab-rails-ce-fips, ruby3.2-rack...
GHSA-Q2WW-5357-X388 vulnerabilities
Vulnerabilities for packages: ruby3.4-rack, ruby3.3-rack, gitlab-rails-ce, kube-fluentd-operator, pact-broker-docker-fips, pact-broker-docker, ruby3.4-rails, ruby3.2-rails, logstash, gitlab-cng, ruby4.0-rack, gitlab-rails-ce-fips, ruby3.2-rack...
GHSA-VGPV-F759-9WX3 vulnerabilities
Vulnerabilities for packages: ruby3.4-rack, ruby3.3-rack, gitlab-rails-ce, kube-fluentd-operator, pact-broker-docker-fips, pact-broker-docker, ruby3.4-rails, ruby3.2-rails, logstash, gitlab-cng, ruby4.0-rack, gitlab-rails-ce-fips, ruby3.2-rack...
GHSA-QFGR-CRR9-7R49 vulnerabilities
Vulnerabilities for packages: kube-fluentd-operator, pact-broker-docker-fips, pact-broker-docker, ruby3.4-rails, ruby3.2-rails, logstash...