3752 matches found
JLSEC-2026-741 Integer underflow in wolfSSL packet sniffer <= 5.9.0 allows an attacker to cause a program crash in...
Integer underflow in wolfSSL packet sniffer = 5.9.0 allows an attacker to cause a program crash in the AEAD decryption path by injecting a TLS record shorter than the explicit IV plus authentication tag into traffic inspected by sslDecodePacket. The underflow wraps a 16-bit length to a large valu...
JLSEC-2026-692 Integer underflow in wolfSSL packet sniffer <= 5.8.4 allows an attacker to cause a buffer overflow...
Integer underflow in wolfSSL packet sniffer = 5.8.4 allows an attacker to cause a buffer overflow in the AEAD decryption path by injecting a TLS record shorter than the explicit IV plus authentication tag into traffic inspected by sslDecodePacket. The underflow wraps a 16-bit length to a large...
Malicious Package
Overview trigger-x-x is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package attempts to impersonate legitimate gaming utilities, bots, or performance panels, it is entirely malicious and has no connection to...
CVE-2026-47475
Summary of CVE-2026-47475 (NVIDIA TensorRT-LLM) : A vulnerability in the OpenAI-compatible inference API could allow an attacker to trigger a reachable assertion in the sampler thread, potentially causing a denial of service. The issue is scoped to NVIDIA TensorRT-LLM, with local attack vector an...
MAL-2026-10537 Malicious code in neon-postgres (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33e264a75c066f784e7900ad4f7f51598022eb9c7858fff489dc1861506ca855 neon-postgres is a clone of the porsager/postgres client with package metadata repository, author, homepage still pointing at the upstream project...
CVE-2025-56361
A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) versions 1.3 through 1.4 (specifically commit ab3d5ae ). The flaw is located within the Level Control cluster 's server tick logic, specifically in the emberAfLevelControlClusterServerTickCallback function. If a MoveTo...
MAL-2026-10494 Malicious code in @quickcall/krew (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cef7755bfdd2bf753ace888115fd963d8c44147bcf715a0e276f4c6d36208770 The quickcall CLI unconditionally starts a telemetry sync daemon at startup dist/main.js invokes startSyncDaemon and registers a session-end hook plu...
CVE-2026-60103
Blender 3.0.0–5.1.2 contains an out-of-bounds read via a crafted .blend SDNA block. The signed short member_index is used as an array index into sdna->members[] in sdna_expand_names() without bounds checking, producing an invalid pointer that is then passed to strlen(), causing a SIGSEGV or un...
PYSEC-2026-2360 Apache Airflow allows users with asset materialize permissions to trigger DAGs outside of their permissions
UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate to Airflow version 3.2.0 that fixes the issue...
CVE-2026-51537
EIPStackGroup OpENer 2.3.0 commit 76b95cf has an out-of-bounds read issue in Connection Manager handling of ForwardOpen requests when processing short malformed packets. An attacker can send a valid ENIP outer frame carrying a malformed CIP ForwardOpen/LargeForwardOpen request, causing the parser...
PT-2026-59314
Summary The ActionHandler.post method in motionEye has no authentication decorator, allowing any unauthenticated attacker to trigger camera actions including snapshots, recording start/stop, and configured action scripts PTZ controls, alarm triggers, etc.. Vulnerability Details File:...
BIT-AIRFLOW-2026-49487 Apache Airflow: Task-instance API exposes secrets in deferred trigger kwargs
In Apache Airflow before 3.3.0, the REST API task-instance detail and list endpoints returned a deferred task's trigger kwargs without masking. When a deferred operator passed a secret for example a provider API key into its trigger, any authenticated user with DAG-scoped task-instance read acces...
Remote Code Execution (RCE)
Joro is vulnerable to Remote Code Execution RCE. The vulnerability is due to the default proxy mode exposing an unauthenticated local API with a wildcard CORS policy, which allows an attacker to use cross-origin JavaScript to upload a malicious native plugin and trigger a restart...
PT-2026-57414
The WCFM – Frontend Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.7.27. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attacker...
Exploit for Improper Input Validation in Motioneye_Project Motioneye
CVE-2025-60787 — motionEye Authenticated RCE Authenticated co...
CVE-2026-56335
Capgo before 12.128.2 contains an authorization bypass vulnerability where write-scoped API keys can directly mutate protected channel configuration fields through PostgREST by exploiting a null authentication check in the immutability trigger. Attackers with write API keys can modify sensitive...
CVE-2026-56335 Capgo - Channel Configuration Mutation via Write-Scoped API Keys
Capgo before 12.128.2 contains an authorization bypass vulnerability where write-scoped API keys can directly mutate protected channel configuration fields through PostgREST by exploiting a null authentication check in the immutability trigger. Attackers with write API keys can modify sensitive...
EUVD-2026-42886
Capgo before 12.128.2 contains an authorization bypass vulnerability where write-scoped API keys can directly mutate protected channel configuration fields through PostgREST by exploiting a null authentication check in the immutability trigger. Attackers with write API keys can modify sensitive...
CVE-2026-56335 Capgo - Channel Configuration Mutation via Write-Scoped API Keys
Capgo before 12.128.2 contains an authorization bypass vulnerability where write-scoped API keys can directly mutate protected channel configuration fields through PostgREST by exploiting a null authentication check in the immutability trigger. Attackers with write API keys can modify sensitive...
Vulnerabilities related to Apache IoTDB permissions, permissions management, and access control
Apache IoTDB is an open-source IoT database developed by the Apache Foundation in the United States. There is a security vulnerability in Apache IoTDB. This vulnerability stems from the internal RPC interface used by DataNode to create Trigger instances, which constructs file paths using the...