475553 matches found
EUVD-2026-50029
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 are affected by a denial of service vulnerability in the HTTP channel due to unbounded allocation of resources without limits...
CVE-2026-14996
IBM Aspera Faspex 5.0.0–5.0.15.4 contains a session-management vulnerability (CVE-2026-14996) with high impact on confidentiality and potential for unauthorized access. The issue affects Faspex 5 deployments prior to 5.0.16 and is addressed by upgrading to IBM Aspera Faspex 5.0.16. This bulletin ...
CVE-2026-59943
Dompdf vulnerability (CVE-2026-59943) affects version 3.15 and earlier. In a data-URI encoded SVG, using an element with href/xlink:href pointing to local files (e.g., file:///...), the rendering process can leak filesystem information by differentiating behavior when a referenced file/directory...
CVE-2026-59943 Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem
Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI...
EUVD-2026-36072
Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape...
CVE-2026-56722 Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI
Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML input can bypass this restriction by embedding a target file path inside an SVG image delivered through a data: URI, because dompdf processes the SVG twice and the second pass does not...
CVE-2026-56722
Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML input can bypass this restriction by embedding a target file path inside an SVG image delivered through a data: URI, because dompdf processes the SVG twice and the second pass does not...
CVE-2026-56722
Dompdf (PHP HTML-to-PDF library) prior to v3.16 is vulnerable to local-file read via SVG in a data: URI. The attack wraps a local file path in an SVG image; dompdf processes the SVG twice, and the second pass hands the image to php-svg-lib with external references enabled. php-svg-lib then reads ...
DEBIAN-CVE-2026-55554
Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri method enforces chroot boundaries with a strpos prefix check after normalizing paths with realpath . Because normalization strips the trailing directory separator from $chrootPath , the check only...
CVE-2026-48060
Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie...
UBUNTU-CVE-2026-55555
Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious HTML that references local files via the file:// protocol repeatedly, an attacker can trigger PHP...
EUVD-2026-36071
Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory...
EUVD-2026-36074
Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAPSYSTIME and cross-tenant node wall-clock corruption...
CVE-2026-15057 IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service due to uncontrolled heap allocation...
CVE-2026-15325 IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities
IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP request smuggling due to improper handling of TRACE requests...
EUVD-2026-50022
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to HTTP request smuggling due to improper handling of TRACE requests...
CVE-2026-16581 Inclusion of sensitive information in source code in igloohome Smart Lock Mobile Application
In igloohome Smart Lock Mobile App versions 3.2.3 and prior, an Inclusion of Sensitive Information in Source Code vulnerability could allow an unauthorized actor to access functions or backend services that were not sufficiently protected by authentication controls...
EUVD-2026-50021
In igloohome Smart Lock Mobile App versions 3.2.3 and prior, an Inclusion of Sensitive Information in Source Code vulnerability could allow an unauthorized actor to access functions or backend services that were not sufficiently protected by authentication controls...
CVE-2026-16107 TS4500 CLI tool addresses security vulnerability
IBM TS4500 CLI tool Versions: 0.1.31 through 1.12.0.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques...