207774 matches found
EUVD-2026-105312
When libcurl uses libssh2 with a hashed knownhosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPTSSHKEYFUNCTION callback...
CVE-2026-87865
When libcurl uses libssh2 with a hashed "knownhosts" file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the "CURLOPTSSHKEYFUNCTION" callback...
CVE-2026-87865
When libcurl uses libssh2 with a hashed knownhosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPTSSHKEYFUNCTION callback...
CVE-2026-87865
A flaw exists in libcurl when used with the libssh2 backend and a hashed known_hosts file . An unrelated initial entry can cause host key validation to incorrectly report a key mismatch as a missing key to the CURLOPT_SSH_KEYFUNCTION callback. A remote attacker who intercepts or controls the SSH ...
CVE-2026-87865
When libcurl uses libssh2 with a hashed knownhosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPTSSHKEYFUNCTION callback...
CVE-2026-112942
A flaw was found in launch-editor. This vulnerability can allow a remote attacker to achieve arbitrary command execution on Windows systems. By submitting a specially crafted file path containing line and column suffixes, an attacker can bypass file existence checks due to improper path validatio...
GHSA-46JR-4WX8-V453 MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
Summary In affected versions, servers put no limit on how many array elements and object keys they validated in one request. One HTTP request within the default 4 MiB size limit could exhaust the server's memory, and the process aborted with JavaScript heap out of memory. No credentials are neede...
MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
Summary In affected versions, servers put no limit on how many array elements and object keys they validated in one request. One HTTP request within the default 4 MiB size limit could exhaust the server's memory, and the process aborted with JavaScript heap out of memory. No credentials are neede...
CVE-2026-113657
A flaw was found in sanitize-html. This vulnerability allows a remote attacker to achieve arbitrary script execution when an application is configured to permit namespace-prefixed Scalable Vector Graphics SVG animation elements. By submitting specially crafted SVG markup, an attacker can bypass U...
CVE-2026-85087
A flaw was found in Apache Thrift's Python bindings. Due to improper certificate validation and incorrect status code handling, client applications fail to properly verify the authenticity of a remote server during encrypted connections. A remote attacker in a man-in-the-middle position could...
CVE-2026-95184
A flaw was found in gnutls. Due to improper certificate validation, the library may incorrectly reject legitimate certificates presented by valid users. This issue can lead to a Denial of Service DoS, preventing authorized clients from establishing secure connections or accessing services...
CVE-2026-95210
A flaw was found in GnuTLS. Improper certificate validation causes the library to accept certificates containing invalid extensions. A remote attacker could exploit this flaw by presenting a specially crafted certificate during a secure connection. Successful exploitation may allow an attacker to...
CVE-2026-95209
A flaw was found in gnutls. An issue during certificate validation causes legitimate Certificate Authority CA certificates to be improperly rejected. Consequently, affected applications fail to establish secure connections with trusted endpoints, resulting in a Denial of Service DoS...
CVE-2026-94636
A flaw was found in Apache Thrift's Python bindings. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service DoS by sending specially crafted input or compressed payloads. Due to improper input validation and improper handling of compressed data, processing these...
CVE-2026-94645
A flaw was found in the Apache Thrift Node.js bindings. A remote attacker can cause a Denial of Service DoS by sending specially crafted input specifying improper quantity values. Because the application fails to properly validate the requested quantity before allocating resources, processing the...
CVE-2026-96234
A flaw was found in .NET. An origin validation error allows an unauthorized remote attacker to disclose sensitive information over the network. Successful exploitation requires user interaction and enables an attacker to access restricted data without proper authorization...
DEBIAN-CVE-2026-113602
json-smart through 2.6.0 contains an input validation bypass vulnerability that allows attackers to evade strict-mode trailing-data checks by inserting a literal 0x1A character. Attackers can append 0x1A and malformed content to pass JSONValue.parseStrict or isValidJsonStrict validation, creating...
CVE-2026-113602
json-smart through 2.6.0 contains an input validation bypass vulnerability that allows attackers to evade strict-mode trailing-data checks by inserting a literal 0x1A character. Attackers can append 0x1A and malformed content to pass JSONValue.parseStrict or isValidJsonStrict validation, creating...
CVE-2026-112951
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the color field accepts trailing content after a valid rgb or hsl prefix because its TinyColor validation does not require the entire value to match a color. An authenticated user with edit rights can store...
CVE-2026-113602 json-smart through 2.6.0 Strict-Mode Validation Bypass via 0x1A Character
json-smart through 2.6.0 contains an input validation bypass vulnerability that allows attackers to evade strict-mode trailing-data checks by inserting a literal 0x1A character. Attackers can append 0x1A and malformed content to pass JSONValue.parseStrict or isValidJsonStrict validation, creating...