101 matches found
CVE-2026-89087
CVE-2026-89087 affects the cstruct package for OCaml in versions before 6.3.0 . The root cause is an index mishandling issue. The assigned CVSS 3.1 score is 7.3 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, indicating a network-reachable flaw requiring no privileges or user interac...
CVE-2026-89087
The cstruct package before 6.3.0 for OCaml mishandles indexes...
OESA-2026-3266 activemq security update
The most popular and powerful open source messaging and Integration Patterns server. Security Fixes: Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All. A remote unauthenticated peer that can reach an exposed AMQP NIO connector can trigger...
CLSA-2026-1772496674 TuxCare security update for semver (1 CVE)
TuxCare rebuilt semver to address 1 CVE. Fixed in 6.3.0-tuxcare.1...
EUVD-2026-49848
Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All. A remote unauthenticated peer that can reach an exposed AMQP NIO connector can trigger denial-of-service behavior by sending a frame size value. This cause the NIO threads to die and if done...
CVE-2026-45799
Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.3.0 and 7.0.0-alpha03, ByteArrayProtoReader32.skipGroup and ProtoReader.skipGroup in wire-runtime do not validate that a LENGTHDELIMITED field length is non-negative before skip, allowing a crafted protobuf...
CVE-2026-45799 Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service
Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.3.0 and 7.0.0-alpha03, ByteArrayProtoReader32.skipGroup and ProtoReader.skipGroup in wire-runtime do not validate that a LENGTHDELIMITED field length is non-negative before skip, allowing a crafted protobuf...
CVE-2025-60080
Deserialization of Untrusted Data vulnerability in add-ons.org PDF for Gravity Forms + Drag And Drop Template Builder pdf-for-gravity-forms allows Object Injection.This issue affects PDF for Gravity Forms + Drag And Drop Template Builder: from n/a through = 6.5.0...
PT-2025-52138
Deserialization of Untrusted Data vulnerability in add-ons.org PDF for Gravity Forms + Drag And Drop Template Builder pdf-for-gravity-forms allows Object Injection.This issue affects PDF for Gravity Forms + Drag And Drop Template Builder: from n/a through = 6.3.0...
EUVD-2021-31816
Malicious code in bioql PyPI...
EUVD-2024-1031
Malicious code in bioql PyPI...
EUVD-2022-51894
Malicious code in bioql PyPI...
EUVD-2022-0747
Malicious code in bioql PyPI...
EUVD-2022-24353
Malicious code in bioql PyPI...
EUVD-2024-41271
Malicious code in bioql PyPI...
CVE-2025-47771 PowSyBl Core allows deserialization of untrusted SparseMatrix data
PowSyBl Power System Blocks is a framework to build power system oriented software. In versions 6.3.0 to 6.7.1, there is a deserialization issue in the read method of the SparseMatrix class that can lead to a wide range of privilege escalations depending on the circumstances. This method takes in...
CVE-2024-31433
Cross-Site Request Forgery CSRF vulnerability in StellarWP The Events Calendar the-events-calendar.This issue affects The Events Calendar: from n/a through = 6.3.0...
CVE-2024-45805
OpenCTI is an open-source cyber threat intelligence platform. Before 6.3.0, general users can access information that can only be accessed by users with access privileges to admin and support information SETTINGSSUPPORT. This is due to inadequate access control for support information...