2275 matches found
MINI-55HP-3W67-PXVW
Bulletin has no description...
CVE-2026-45756 Symfony: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.3.0-BETA1 until 7.4.12 and 8.0.12, the JsonPath component compiles attacker-controlled match and search filter patterns directly into pregmatch without a length cap, i-regexp restriction, or...
CVE-2026-50506
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network...
CVE-2026-45646
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network...
MINI-V7W8-GGJ3-R6C3
Bulletin has no description...
MINI-XCHC-J6G8-G5Q8
Bulletin has no description...
CVE-2026-49788: Allocation of Resources Without Limits or Throttling
Allocation of resources without limits or throttling in HTTP/2 allows an unauthorized attacker to deny service over a network...
CVE-2026-24271: Allocation of Resources Without Limits or Throttling
NVIDIA TensorRT-LLM contains a vulnerability in the OpenAI-compatible inference API, where an attacker could cause allocation of GPU resources without limits or throttling. A successful exploit of this vulnerability might lead to denial of service...
ROS-20260714-73-0031
The vulnerability of the GNW protocol analyzer, which is part of the Wireshark network traffic analyzer, relates to the execution of a loop with an unavailable exit condition. Exploiting this vulnerability can allow attackers to cause service failures...
Information Exposure
Overview Affected versions of this package are vulnerable to Information Exposure via the varianturl process. An attacker can access sensitive identity-document images by obtaining and replaying signed Active Storage URLs embedded in admin review pages, without requiring authentication. This is...
PYSEC-2026-2909 PraisonAI's symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`
Summary The safeextractall helper that all recipe pull, recipe publish, and recipe unpack flows route through validates each archive member's name for absolute paths, .. segments, and resolved-path escape — but does not validate member.linkname, does not reject symlink/hardlink members, and calls...
CVE-2026-9824 Remote cluster metadata enumeration via /share-channel autocomplete
Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4, 10.11.x = 10.11.19 fail to check the managesharedchannels permission in the /share-channel autocomplete handler, which allows an authenticated user without that permission to enumerate configured remote cluster connection metadata via slash...
CVE-2026-12396
The WP Job Portal WordPress plugin before 2.5.5 does not perform capability or ownership checks before allowing job moderation actions, allowing authenticated users with a subscriber-level self-registerable account to approve, feature, or reject arbitrary jobs, including those owned by other user...
PT-2026-59201
Impact So far, kas checks out and processes repositories regarding configuration includes prior to validating signatures of those repositories. This may allow to replace on original repository with one under the control of an attacker under very specific conditions. First of all, the attacker mus...
PT-2026-59404
Summary Open WebUI v0.9.5 lets an authenticated user attach arbitrary file id values to their own chat message without checking whether they own or can read those files. If the attacker then shares that chat and grants themselves read access, has access to file treats the victim file as accessibl...
MINI-3H6X-6WRJ-HF37
Bulletin has no description...
MINI-MX6M-5W8M-VM4R
Bulletin has no description...
MINI-2MGX-V65P-7H4C
Bulletin has no description...