CVE-2024-52581

CVE-2024-52581 affects Litestar (ASGI framework). The vulnerability arises in the multipart/form-data parsing path prior to version 2.13.0, where the parser reads the entire request body into memory without a size limit, enabling unbounded memory consumption (DoS) on large uploads. The issue is t...

CVE-2023-24537

CVE-2023-24537 affects the Go parser (go/parser) when processing Go source containing //line directives with very large line numbers, causing an infinite loop due to integer overflow. Documents confirm this vulnerability in golang/go and note that patched versions are available in affected distri...

CVE-2022-24407

CVE-2022-24407 affects Cyrus SASL 2.1.17–2.1.27 (before 2.1.28); the SQL plugin (plugins/sql.c) fails to escape passwords in SQL INSERT/UPDATE, allowing a remote attacker to execute arbitrary SQL commands. This can enable privilege/escalation scenarios as described in vendor advisories. The mitig...

CVE-2019-16746

CVE-2019-16746 : A buffer overflow in the Linux kernel (net/wireless/nl80211.c) can occur through improper bounds checking of variable-length elements in a beacon head, enabling potential arbitrary code execution or a system crash. The issue affects Linux kernels up to at least 5.2.17, with repor...

CVE-2024-27954

WordPress Automatic plugin

CVE-2024-4058

Google Chrome versions prior to 124.0.6367.78 are vulnerable to a type confusion issue in the ANGLE component. This vulnerability could allow a remote attacker to exploit heap corruption by navigating to a crafted HTML page . The vulnerability is rated as Critical by Chromium security. Specific e...

CVE-2017-12171

CVE-2017-12171 is a vulnerability reported for Red Hat Enterprise Linux 6.9 with httpd 2.2.15-60. The regression causes comments in the Allow and Deny directives to be parsed incorrectly, potentially allowing a remote attacker to bypass access controls and gain access to a restricted HTTP resourc...

CVE-2010-3904

CVE-2010-3904 is a Linux kernel flaw in the RDS implementation where rds_page_copy_user does not validate user-space addresses, enabling local privilege escalation via crafted sendmsg/recvmsg calls. Affected: Linux kernels prior to 2.6.36; fixed in later kernel releases (e.g., Red Hat/CentOS advi...

CVE-2024-53582

A directory traversal vulnerability exists in the File Manager component of OpenPanel v0.3.4 within the Copy and View functions. An attacker can exploit this by sending a crafted HTTP request to access files outside the intended directory. Exploitation proof-of-concepts are available on Exploit-D...

CVE-2022-48174

CVE-2022-48174 is a stack overflow in BusyBox ash.c:6030 affecting versions before 1.35. In Internet of Vehicles contexts this can enable arbitrary code execution from a crafted input command. Public details confirm the vulnerability in BusyBox prior to 1.35 and indicate exposure in IoT environme...

CVE-2022-31105

Argo CD versions 0.4.0–2.2.11, 2.3.6–2.4.5 are affected by an improper certificate validation when connecting to OIDC providers, risking trust in a malicious provider. Patches were released in 2.2.11, 2.3.6, and 2.4.5. Upgrading to these patched releases (or newer) is the recommended fix. A parti...

CVE-2026-41703

CVE-2026-41703 is an out-of-bounds read vulnerability affecting VMware ESX, Workstation, and Fusion. A malicious actor with VM deployment privileges could trigger memory access violations, potentially leading to information disclosure or, more likely, a DoS on the host process; in Workstation and...

CVE-2023-30590

CVE-2023-30590 concerns Node.js: the generateKeys() API of crypto.createDiffieHellman() only generates a private key when none is set, yet docs claim it generates both private and public DH keys. Multiple advisories (Debian DLA/DSA, Gentoo GLSA, AlmaLinux errata) reference this vulnerability and ...

CVE-2023-22028

CVE-2023-22028 affects Oracle MySQL Server (Server: Optimizer). Affected: MySQL 5.7.x up to 5.7.43 and 8.0.x up to 8.0.31. Exploitation can lead to a high-privilege attacker over network causing a hang or frequent crash (DoS) of MySQL Server. Connected sources indicate Oracle CPU advisory and ven...

CVE-2022-29097

Dell Wyse Management Suite versions prior to 3.7 (3.6.1 and below) are affected by a Path Traversal vulnerability in the Device API (CVE-2022-29097), allowing remote attackers with the web app privileges to read files on the server. Nessus/DSA-2022-143 references this issue among multiple vulnera...

CVE-2022-24872

Shopware CVE-2022-24872 is an improper access‑control issue in the admin-api where permissions set to the sales channel context can be used within a normal user session. Affects Shopware platform (Symfony/Vue) across affected releases; remediation is to update to version 6.4.10.1. For 6.1–6.3, se...

CVE-2018-17082

The CVE-2018-17082 entry covers a cross-site scripting vulnerability in the Apache2 module of PHP. Affected releases are PHP with Apache2 handler: PHP 5.6.38 and earlier in 5.6.x; 7.0.x before 7.0.32; 7.1.x before 7.1.22; and 7.2.x before 7.2.10. The root cause is mishandling of the bucket brigad...

CVE-2026-48907

CVE-2026-48907 — Joomla JCE extension unauthenticated RCE is a vulnerability in the Joomla Content Editor (JCE) that allows unauthenticated users to create editor profiles and upload PHP payloads, enabling remote code execution. Technical details across documents show an unrestricted file upload ...

CVE-2025-21502

CVE-2025-21502 affects Oracle Java SE and related GraalVM packages (Hotspot) across multiple supported versions (Java SE 8u431-perf, 11.0.25, 17.0.13, 21.0.5, 23.0.1; GraalVM JDK 17.0.13/21.0.5/23.0.1; GraalVM EE 20.3.16/21.3.12). The described vulnerability allows an unauthenticated, network-acc...

CVE-2023-43622

CVE-2023-43622 affects Apache HTTP Server via the mod_http2 implementation. An attacker opening an HTTP/2 connection with an initial window size of 0 could block handling of that connection indefinitely, potentially exhausting server worker resources in a pattern similar to the slow loris attack....

CVE-2023-36805

Technical details for CVE-2023-36805 are not publicly provided in the supplied documents. Monitor for updates from official advisories.

CVE-2023-34417

CVE-2023-34417 concerns memory-safety bugs in Mozilla Firefox 113 that could allow arbitrary code execution. The impact is noted for Firefox < 114, with high-severity CVSS 9.8 in the NVD entry. Public sources in connected documents confirm the issues affect Firefox prior to 114 and that fixes ...

CVE-2021-44026

CVE-2021-44026 concerns Roundcube Webmail, where versions prior to 1.3.17 and 1.4.x prior to 1.4.12 are vulnerable to SQL injection via search or search_params. The issue is documented in multiple advisories and CVE trackers, with Debian and Fedora indicating fixes in 1.2.3+dfsg.1-4+deb9u9 / 1.4....

CVE-2018-19296

PHPMailer (versions before 5.2.27 and 6.x before 6.0.6) is affected by an object injection vulnerability (CVE-2018-19296). The issue stems from how attachments may be processed, enabling an attacker to inject objects via crafted input, potentially leading to code execution. Patches were released ...

CVE-2004-2687

CVE-2004-2687 concerns distcc (distccd) where, if the server port is not access-restricted, remote attackers can execute arbitrary commands via compilation jobs. The core issue is lack of authorization checks in the distccd daemon when handling distributed compilation requests. Affected scope app...

CVE-2026-64600

The CVE-2026-64600 issue affects the Linux kernel’s XFS implementation. The race arises when xfs_reflink_fill_{cow_hole,delalloc} cycle the ILOCK to obtain a transaction, leaving data fork and cow fork mappings stale after reacquiring the ILOCK. Specifically, the data fork mapping was not refresh...

CVE-2023-0401

CVE-2023-0401 describes a NULL pointer dereference during PKCS7 data verification in OpenSSL. The digest initialization can fail when the signature hash algorithm is known but the implementation is unavailable, due to a missing check on the initialization return value. This can lead to invalid di...

CVE-2022-29161

CVE-2022-29161 concerns the XWiki Platform Crypto API generating X509 certificates signed by default with SHA-1 with RSA , a deprecated algorithm due to collision risks. The issue was patched in XWiki versions 13.10.6, 14.3.1 and 14.4-rc-1 , after which the API signs certificates with SHA-256 wit...

CVE-2022-33891

Summary: CVE-2022-33891 is a command-injection vulnerability in the Apache Spark UI when ACLs are enabled. A code path in HttpSecurityFilter can impersonate by supplying an arbitrary username, leading to an arbitrary shell command being executed as the Spark process user. Affected versions includ...

CVE-2019-11039

CVE-2019-11039 – PHP iconv_mime_decode_headers out-of-buffer read Description: The vulnerability arises in PHP’s MIME header parsing in function iconv_mime_decode_headers(), vulnerable versions include PHP 7.1.x < 7.1.30, 7.2.x < 7.2.19, and 7.3.x

CVE-2023-32315

Openfire (Ignite Realtime) is affected by a path traversal vulnerability in the web-based Admin Console exposed via the unauthenticated Setup Environment, permitting access to admin pages in an already configured Openfire instance. Affected versions are Openfire releases since April 2015 starting...

CVE-2023-26359

CVE-2023-26359 affects Adobe ColdFusion 2018 Update 15 and earlier, and 2021 Update 5 and earlier, via a Deserialization of Untrusted Data vulnerability that could lead to arbitrary code execution in the current user context. Exploitation does not require user interaction. Publicly available deta...

CVE-2019-10768

CVE-2019-10768 affects AngularJS before 1.7.9. The function merge() could be tricked into adding or modifying properties of Object.prototype via a proto payload, enabling prototype pollution. IBM/X-Force data in connected docs corroborates the vulnerability and the CVSS metrics (base scores 7.3 i...

CVE-2018-8171

CVE-2018-8171 is a Security Feature Bypass in ASP.NET where the system fails to validate the number of incorrect login attempts. Affected components include ASP.NET, ASP.NET Core 1.x (1.0–1.1), and ASP.NET MVC 5.2. The root cause is improper login attempt validation, enabling an attacker to repea...

CVE-2022-26833

The CVE-2022-26833 issue affects Open Automation Software OAS Platform V16.00.0121. A vulnerability in the REST API allows unauthenticated use via a crafted sequence of HTTP requests, stemming from improper authentication. Consequences cited in the sources include unauthenticated access to the RE...

CVE-2022-24860

Databasir 1.01 contains a hard-coded cryptographic key vulnerability that lets an attacker generate login credentials for any user and access the backend service at different IP addresses. This is described across multiple sources (NVD description, Red Hat entry, CVE listings) as a use of hard-co...

CVE-2024-6232

CVE-2024-6232 affects CPython: tarfile.TarFile header parsing RegEx backtracking causes a ReDoS, with a base score of 7.5 (HIGH). Attack vector is NETWORK and requires no privileges or user interaction. Impact is listed as Availability impact being HIGH; Confidentiality/Integrity are NONE. The is...

CVE-2023-35311

Technical details about CVE-2023-35311 are not publicly available in the provided connected documents. The sources confirm a Microsoft Outlook security feature bypass but do not specify root cause, affected versions, or fixes. Monitor for updates.

CVE-2021-43527

CVE-2021-43527 describes a heap overflow in NSS when handling DER-encoded DSA or RSA-PSS signatures. The vulnerability affects NSS versions prior to 3.73 (and 3.68.1 ESR for some configurations) and can impact applications using NSS for signatures in CMS, S/MIME, PKCS#7, or PKCS#12, as well as th...

CVE-2019-18217

ProFTPD vulnerability CVE-2019-18217 causes remote unauthenticated Denial of Service due to improper handling of overly long commands, leading a child process to enter an infinite loop in main.c. Affected versions include 1.3.6b and 1.3.7rc before 1.3.7rc2; exploitation could impact availability ...

CVE-2017-1000251

CVE-2017-1000251 affects the Linux kernel Bluetooth subsystem (BlueZ) in L2CAP processing, causing a stack buffer overflow when handling configuration responses. Affected range includes kernels from 2.6.32 up to 4.13.1. Exploitation could crash the system or, in some deployments, allow remote cod...

CVE-2021-2007

CVE-2021-2007 affects Oracle MySQL MySQL Client (C API). Affected versions: 5.6.47 and prior, 5.7.29 and prior, and 8.0.19 and prior. The vulnerability is exploitable by an unauthenticated attacker with network access via multiple protocols, potentially leading to unauthorized read access of a su...

CVE-2020-7060

CVE-2020-7060: In PHP mbstring mbfl_filt_conv_big5_wchar, crafted data can read past the allocated buffer, causing information disclosure or crash. Affected: PHP 7.2.x < 7.2.27, 7.3.x < 7.3.14, 7.4.x

CVE-2022-23451

CVE-2022-23451 concerns openstack-barbican. The issue is an authorization flaw where default secret-metadata API policy allows any authenticated user to add/modify/delete metadata on any secret, compromising ownership and enabling denial of service by resource consumption. The impact is described...

CVE-2021-23343

CVE-2021-23343 affects the path-parse package. The vulnerability is a Regular Expression Denial of Service (ReDoS) via the regexes splitDeviceRe, splitTailRe, and splitPathRe. The ReDoS has polynomial worst-case time complexity. Connected telemetry from MiracleLinux AXSA advisories lists path-par...

CVE-2019-11040

CVE-2019-11040 describes a heap/buffer over-read in PHP’s EXIF extension during EXIF data parsing (exif_read_data()). Affected are PHP 7.1.x < 7.1.30, 7.2.x < 7.2.19, and 7.3.x

CVE-2018-20783

CVE-2018-20783 affects PHP’s PHAR extension. A heap-based buffer over-read occurs in PHAR reading functions when parsing a .phar file name, allowing memory past the actual data to be read. Affected versions include PHP <5.6.39, 7.x <7.0.33, 7.1.x <7.1.25, and 7.2.x

CVE-2026-49975

The Apache HTTP Server is vulnerable to a Denial of Service (DoS) attack due to a memory allocation vulnerability with an excessive size value in the mod_http component. Specifically, this flaw allows for memory exhaustion via malicious HTTP requests, which can be triggered by a compression bomb ...

CVE-2024-53104

CVE-2024-53104 affects the Linux kernel USB Video Class (UVC) driver, specifically the uvc_parse_format logic which should skip frames of type UVC_VS_UNDEFINED. The fix prevents an out-of-bounds write in uvc_parse_streaming caused by mis-sized frame buffers, addressing an out-of-bounds write vuln...

CVE-2024-31621

FlowiseAI Inc Flowise versions v.1.6.2 and before (and some sources indicate prior to v.1.8.1 ) are vulnerable to a Code Injection (CWE-94) flaw. Due to improper input validation in the api/v1 component, a remote attacker can execute arbitrary code by submitting a crafted script. Additionally, ve...