475726 matches found
Non-constant time webhook bearer token comparison in webhook-secret-credentials-provider
webhook-secret-credentials-provider 16.v0cfaf0215cf5 and earlier does not use a constant-time comparison function when checking whether the provided and expected webhook bearer token are equal. This could potentially allow attackers to use statistical methods to obtain a valid webhook bearer toke...
CVE-2026-67871
Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the AddNodes, addressspacebs.c, sopcnodemgthelperinternal.c, and toolkittestserver...
EUVD-2025-210619
Zosi C519M V4.2.8.823C01450BA is vulnerable to Incorrect Access Control. The application contains hardcoded credentials in the RTSP authentication mechanism. An attacker with network access can use the unchangeable default credentials to access the RTSP video stream, resulting in unauthorized...
CVE-2026-67872
An issue in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the event monitored-item queue resize handling...
Oracle Linux 9 : p11-kit (ELSA-2026-49667)
The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-49667 advisory. 0.26.2-1 - Rebase to 0.26.2 Resolves: RHEL-147825 0.26.1-1 - Rebase to 0.26.1 Resolves: RHEL-139075, RHEL-118361, RHEL-126132 0.25.10-1 - Update to new upstrea...
Linux Distros Unpatched Vulnerability : CVE-2026-67590
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid...
RHEL 9 : python3.12 (RHSA-2026:50770)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:50770 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...
OpenSSL 3.6.0 < 3.6.4 Vulnerability
The version of OpenSSL installed on the remote host is prior to 3.6.4. It is, therefore, affected by a vulnerability as referenced in the 3.6.4 advisory. - Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP...
EUVD-2026-53010
OpenSIPS is a Session Initiation Protocol SIP server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the SDP bandwidth-line parsing logic. A SIP request with Content-Type: application/sdp and a malformed session-level SDP bandwidth line missing t...
CVE-2026-18819
A security vulnerability has been detected in RackTables up to 0.22.0/e5fff9f8aab339798ed47e8c6d7d977ed97a82bd. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack is possible to be carried out remotely. The exploit has been disclosed publicly...
CVE-2026-45705
OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the findlinedelimiter function in the multipart body parser performs an out-of-bounds read via strncmp when searching for MIME boundary delimiters. After finding a -- pattern near the en...
openjdk: Enhance Jar handling (Oracle CPU 2026-07)
A flaw was found in OpenJDK. There exists a potential existential forgery vulnerability in CMS and protocols which use CMS. In Java, CMS is used to sign JAR files...
CVE-2026-45537 OpenSIPS: Global Buffer Overflow in construct_uri
OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the constructuri function concatenates multiple URI components protocol, username, domain, port, params into a fixed 1024-byte global BSS buffer without any bounds checking. When a routi...
CVE-2026-45537 OpenSIPS: Global Buffer Overflow in construct_uri
OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the constructuri function concatenates multiple URI components protocol, username, domain, port, params into a fixed 1024-byte global BSS buffer without any bounds checking. When a routi...
CVE-2026-18819
RackTables
CVE-2026-70594
Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks. Successful exploitation would have required another vulnerability on the same domain where Ghost Admin was hosted...
DEBIAN-CVE-2026-67860
open62541 1.5.5 contains a heap-based buffer overflow in the default HistoryRead path when the default history database is used with the memory backend...
CVE-2026-67862
open62541 1.5.5 contains a buffer-overflow in the high-level attribute reading logic in src/client/uaclienthighlevel.c. This allows a remote attacker to cause a denial of service...
CVE-2026-70589
Ghost is a Node.js content management system. From 4.22.0 until 6.54.1, a missing validation check allowed users to redeem subscription offers that were no longer active. This issue is fixed in version 6.54.1...