209872 matches found
CVE-2026-112050
Gitify before 7.10.0 contains a login cross-site request forgery vulnerability that allows remote attackers to bind a victim's client to their account because performGitHubWebOAuth omits OAuth state validation. Attackers can get a gitify://oauth?code= link with their own authorization code opened...
CVE-2026-112058
A flaw was found in libdvdnav. An attacker could trigger a Denial of Service DoS by convincing a user to load a specially crafted DVD or disc image. Due to missing input validation in the setPTT function, an invalid title number causes the library to read memory beyond allocated boundaries, leadi...
CVE-2026-112050 Gitify before 7.10.0 Login CSRF via Missing OAuth State Validation
Gitify before 7.10.0 contains a login cross-site request forgery vulnerability that allows remote attackers to bind a victim's client to their account because performGitHubWebOAuth omits OAuth state validation. Attackers can get a gitify://oauth?code= link with their own authorization code opened...
CVE-2026-112050 Gitify before 7.10.0 Login CSRF via Missing OAuth State Validation
Gitify before 7.10.0 contains a login cross-site request forgery vulnerability that allows remote attackers to bind a victim's client to their account because performGitHubWebOAuth omits OAuth state validation. Attackers can get a gitify://oauth?code= link with their own authorization code opened...
CVE-2026-112050
Gitify before 7.10.0 contains a login cross-site request forgery vulnerability that allows remote attackers to bind a victim's client to their account because performGitHubWebOAuth omits OAuth state validation. Attackers can get a gitify://oauth?code= link with their own authorization code opened...
CVE-2026-112050 Gitify before 7.10.0 Login CSRF via Missing OAuth State Validation
Gitify before 7.10.0 contains a login cross-site request forgery vulnerability that allows remote attackers to bind a victim's client to their account because performGitHubWebOAuth omits OAuth state validation. Attackers can get a gitify://oauth?code= link with their own authorization code opened...
EUVD-2026-103512
Gitify before 7.10.0 contains a login cross-site request forgery vulnerability that allows remote attackers to bind a victim's client to their account because performGitHubWebOAuth omits OAuth state validation. Attackers can get a gitify://oauth?code= link with their own authorization code opened...
CVE-2026-112050
Versions of Gitify before 7.10.0 are vulnerable to a login cross-site request forgery (CSRF) . The issue stems from the performGitHubWebOAuth() function omitting OAuth state validation . A remote attacker can trick a victim into binding their client to the attacker's account by providing a gitify...
DEBIAN-CVE-2026-112006
OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTELEXPORTEROTLPCERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alte...
CVE-2026-112006
OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTELEXPORTEROTLPCERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alte...
CVE-2026-112003
ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan that allows staff with importorphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans import or delete endpoints, deleting or adopting other owners' files...
CVE-2026-112006
A flaw was found in opentelemetry-exporter-otlp-proto-http. When certificate configuration environment variables are set to empty strings, Transport Layer Security TLS verification is unintentionally disabled. A man-in-the-middle attacker can exploit this improper certificate validation to...
CVE-2026-112006
OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTELEXPORTEROTLPCERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alte...
CVE-2026-112006 OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 Improper Certificate Validation
OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTELEXPORTEROTLPCERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alte...
CVE-2026-112006
OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTELEXPORTEROTLPCERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alte...
CVE-2026-112006 OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 Improper Certificate Validation
OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTELEXPORTEROTLPCERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alte...
EUVD-2026-103459
OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTELEXPORTEROTLPCERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alte...
CVE-2026-112006 OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 Improper Certificate Validation
OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTELEXPORTEROTLPCERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alte...
CVE-2026-112006
The opentelemetry-exporter-otlp-proto-http library (versions 1.5.0 before 1.45.0) is vulnerable to improper certificate validation . The root cause is that TLS verification is disabled when the OTEL_EXPORTER_OTLP_CERTIFICATE variables are provided as empty strings. This allows man-in-the-middle a...
CVE-2026-112003 ProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/Delete
ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan that allows staff with importorphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans import or delete endpoints, deleting or adopting other owners' files...