175290 matches found
CVE-2026-35869
A Command Injection vulnerability exists in the bsSetLimitCliinfo function within the libshare.so library of LB-link Router AC450M V4.0.0. This flaw occurs due to insufficient validation and sanitization of user-supplied input before it is passed to a system-level command execution context. An...
CVE-2026-18374
Passing an effectively empty string to the ,ccs= syntax extension of the mode argument in the fopen function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in...
EUVD-2026-67229
Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the automatic image-download feature accepts file:// URLs in a note's img tags and reads the referenced local file with no path validation, allowing any authenticated user to disclose arbitrary files...
CVE-2026-53580
Trilium is an open-source hierarchical note-taking application affected in versions prior to 0.104.0 . The automatic image-download feature accepts file:// URLs in tags within text notes and performs a filesystem read with no path validation . Because the HTML sanitizer allows the file scheme, a...
CVE-2026-53580 Trilium arbitrary file read and denial of service via file:// URLs in the automatic image-download feature
Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the automatic image-download feature accepts file:// URLs in a note's img tags and reads the referenced local file with no path validation, allowing any authenticated user to disclose arbitrary files...
CVE-2026-53580 Trilium arbitrary file read and denial of service via file:// URLs in the automatic image-download feature
Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the automatic image-download feature accepts file:// URLs in a note's img tags and reads the referenced local file with no path validation, allowing any authenticated user to disclose arbitrary files...
Security Bulletin: IBM Financial Transaction Manager is impacted by multiple vulnerabilities in RedHat Proxy for Kubernetes RBAC authorization
Summary IBM Financial Transaction Manager for RedHat OpenShift has addressed the following vulnerabilities. Vulnerability Details CVEID:CVE-2025-68121 DESCRIPTION: During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial...
EUVD-2026-67212
A MongoDB C driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a value supplied as a replacement is forwarded to the server without neutralization of query-language special elements. An application that passes untrusted,...
CVE-2026-81528
CVE-2026-81528 affects the MongoDB C# driver , where the document-replacement code path omits the element-name/shape validation applied by equivalent write paths. This allows NoSQL injection : an application passing untrusted, loosely-typed input as a replacement value can have that input interpr...
NoSQL injection via array replacement bypassing update shape validation in driver write path
A MongoDB C driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a value supplied as a replacement is forwarded to the server without neutralization of query-language special elements. An application that passes untrusted,...
CVE-2026-81528 NoSQL injection via array replacement bypassing update shape validation in driver write path
A MongoDB C driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a value supplied as a replacement is forwarded to the server without neutralization of query-language special elements. An application that passes untrusted,...
EUVD-2026-67208
A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application that incorporates untrusted input into these name components can have...
EUVD-2026-67207
A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of...
CVE-2026-81523
A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of...
CVE-2026-81523 Cross-tenant database retargeting via dot/NUL injection in namespace strings in libmongocrypt
A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of...
Cross-tenant database retargeting via dot/NUL injection in namespace strings in libmongocrypt
A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of...
CVE-2026-81523
A missing input-validation flaw in MongoDB libmongocrypt 's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The CVELIST record further specifies the mechanism as dot/NUL injection in namespace strings, enabling cross-tenant data...
CVE-2026-81523 Cross-tenant database retargeting via dot/NUL injection in namespace strings in libmongocrypt
A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of...
EUVD-2026-67206
A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed at a different...
CVE-2026-59317
Spring for Apache Kafka is vulnerable to a denial of service via a poison-pill loop caused by missing header validation in DeadLetterPublishingRecovererFactory . The component reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new B...