209753 matches found
Joe Smart-SSO: Input validation vulnerability
Joe Smart-SSO versions 2.1.1 and earlier have a vulnerability in input validation. This vulnerability stems from the /login handler not verifying the redirectUri parameter properly. An open redirection exists, which may allow unauthenticated attackers to steal OAuth2 authorization codes and obtai...
Anthropic Claude Agent SDK for Python: Input validation vulnerability
The Anthropic Claude Agent SDK for Python versions prior to 0.2.121 contain security vulnerabilities. These vulnerabilities stem from the resumption option being passed as an independent token to the Claude CLI without verification. Values starting with a dash are interpreted as independent CLI...
Guangzhou Juan IoT EseeCloud App has a vulnerability in input validation.
The Guangzhou Juan IoT EseeCloud App versions 4.9.6 and earlier, as well as the EseeCloud Firmware version 4.9.86.0 and earlier, have a vulnerability in input validation. This vulnerability arises from improper verification of device unbinding and re-binding operations by the server. Attackers ca...
Mattermost input validation vulnerability
Mattermost versions 11.10.0 and earlier of 11.10.x series, 11.7.9 and earlier of 11.7.x series, 11.9.1 and earlier of 11.9.x series, and 11.8.5 and earlier of 11.8.x series have a input validation vulnerability. This vulnerability stems from the failure to verify the integrity of the SAML...
Devolutions Server has a vulnerability related to input validation errors.
Devolutions Server 2026.3.8.0 and earlier versions have a vulnerability related to input validation errors. This vulnerability stems from improper control over the JIT privilege settings in the PAM checkout process. It may allow authenticated users with PAM checkout access to delete any Active...
CVE-2026-100352 kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client can send an...
CVE-2026-100352 kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client can send an...
Astra Linux – vulnerability in rabbitmq-server
RabbitMQ versions prior to 3.8.16 are vulnerable to a denial-of-service issue due to improper input validation in the AMQP 1.0 client connection endpoint. A malicious user can exploit this vulnerability by sending malicious AMQP messages to a target RabbitMQ instance that has the AMQP 1.0 plugin...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: f2fs: A fix was made to perform a sanity check on the destination blkaddr during recovery. As Wenqing Liu reported in Bugzilla: https://bugzilla.kernel.org/showbug.cgi?id=216456 loop5: A change in capacity was detected, from 0...
Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: Wifi: ath11k: Fixed corruption of SKBs in the REO destination ring. While running traffic for a long time, a random RX descriptor filled with the value “0” from the REO destination ring is received. This invalid descriptor...
Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: scsi: iscsitcp: It is necessary to check that sock is valid before assigning it to iscsisetparam. The validity of sock should be checked before assigning it to prevent incorrect values. The change introduced in commit 57569c37f0a...
Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: jfs: jfsdmap: Validates dbl2nbperpage during mounting In jfsdmap.c, on line 381, BLKTODMAP is used to obtain a logical block number within dbFree. dbl2nbperpage, which represents the log2 of the number of blocks per page, is pass...
Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: md/raid10: fixed the incorrect setting of maxcorrreaderrors. There is no input validation when using the echo md/maxreaderrors command, and an overflow might occur. Add validation for the input number...
Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: dccp: copying the entire header to the stack buffer, not just the basic header Eric Dumazet states that: nfconntrackdccppacket has a unique mechanism: dh = skbheaderpointerskb, dataoff, sizeofdh, &dh; And...
Astra Linux – Vulnerability in Chromium
Insufficient data validation in Animation in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Insufficient validation of untrusted input in the Reading Mode of Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Insufficient validation of untrusted inputs in the Network component of Google Chrome before version 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass the same-origin policy through a crafted HTML page. Chromium security severity: Low...
Astra Linux – Vulnerability in Chromium
Insufficient validation of untrusted input in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
Insufficient validation of untrusted input in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: Low...
Astra Linux – Vulnerability in Chromium
Insufficient validation of untrusted input in Navigation in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: High...