476217 matches found
CVE-2026-18427
CVE-2026-18427 affects @fastify/static prior to version 10.1.3. The patch left gaps in path canonicalization: dot segments, encoded dots, duplicate slashes, and backslashes were not normalized before route matching or serving, enabling an unauthenticated bypass of route-based guards for a protect...
EUVD-2026-54082
URL Redirection to Untrusted Site 'Open Redirect' vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to force visitors of a page to navigate to a site of the attacker's choosing via a element in sanitized HTML. HtmlSanitizeEx.html5/1 keeps attacker-supplied...
EUVD-2026-54079
A security vulnerability has been detected in NocteDefensor LudusMCP up to 1.0.24. The impacted element is an unknown function of the file src/tools/ludusEnvironmentGuidesSearch.ts of the component ludusenvironmentguidessearch. Such manipulation of the argument guidename leads to path traversal...
CVE-2026-19046
CVE-2026-19046 affects NocteDefensor LudusMCP (up to 1.0.24). The vulnerable element is an unknown function in src/tools/ludusEnvironmentGuidesSearch.ts of the ludus_environment_guides_search component. According to the description, manipulating the guide_name argument enables path traversal, wit...
CVE-2026-70646
aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, WebhookHandler.feedupdate deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will...
CVE-2025-49506
APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or Android. Users are...
CVE-2025-49506
APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or Android. Users are...
CVE-2026-32327
CVE-2026-32327 concerns the APR-util library. The connected sources confirm a vulnerability in version 1.6.3 and earlier where a stack recursion flaw can be triggered by XML parsing from untrusted sources via the apr_xml_quote_elem() function, potentially causing a crash. The issue affects APR-ut...
CVE-2026-32327 Apache Portable Runtime Utility: apr-util XML stack recursion crash
A bug in APR-util version 1.6.3 and earlier allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the aprxmlquoteelem function. Users are recommended to upgrade to version 1.6.4, which fixes this issue...
CVE-2026-34191 Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Portable Runtime Utility via aprdbdoracle provider. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3...
EUVD-2026-53917
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue...
CVE-2026-34501 Apache Portable Runtime Utility: Heap buffer overflow in APR redis client
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue...
CVE-2026-34502 Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3...
EUVD-2026-53916
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3...
CVE-2026-34502
CVE-2026-34502 corresponds to a Heap-based Buffer Overflow in the Apache Portable Runtime Utility memcached client, affecting APR Utility versions 1.3.0 through 1.6.3. The entry notes a NETWORK attack vector with LOW attack complexity and NO privileges required, and an impact profile of Availabil...
CVE-2026-66710 WordPress e2pdf plugin <= 1.32.40 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in e2pdf = 1.32.40 versions...
EUVD-2026-53911
Unauthenticated Broken Access Control in Total Upkeep = 1.17.2 versions...
CVE-2026-66708
CVE-2026-66708 affects the WordPress plugin Total Upkeep (versions