CVE-2023-4586

CVE-2023-4586 (Hot Rod client) is described as a vulnerability where the Hot Rod client does not enable hostname validation when using TLS, which could enable a man-in-the-middle (MITM) attack and compromise the confidentiality of communications. The connected materials reaffirm the same issue an...

CVE-2023-29406

CVE-2023-29406 affects Go's HTTP/1 client: the Host header is not fully validated, enabling a malicious Host header to inject additional headers or entire requests. Public details in connected advisories show affected Go package versions and patch guidance, e.g., golang packages for versions <...

CVE-2023-26048

CVE-2023-26048 (Jetty) affects Jetty’s Java-based web server/servlet engine. Affected servlets using multipart support (e.g., @MultipartConfig) calling HttpServletRequest.getParameter() or getParts() may trigger an OutOfMemoryError when a client sends a multipart part with a name but no filename ...

CVE-2022-30209

Technical details (affected products, exploit vector, root cause, and remediation) are not provided in the supplied documents. Monitor for updates from official sources.

CVE-2019-13132

CVE-2019-13132 concerns ZeroMQ libzmq: a remote, unauthenticated client connecting to a libzmq app with a CURVE-enabled listening socket can trigger a stack/buffer overflow in the library, for libzmq versions up to just before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.3.2. Public servers runn...

CVE-2017-3145

CVE-2017-3145 affects BIND: the resolver incorrectly sequenced cleanup operations on upstream recursion fetch contexts, causing a use-after-free that can trigger an assertion failure and crash named. Affected versions include BIND 9.0.0 through 9.8.x, 9.9.0–9.9.11, 9.10.0–9.10.6, 9.11.0–9.11.2, 9...

CVE-2015-0235

CVE-2015-0235 (GHOST) is a heap-based buffer overflow in glibc’s __nss_hostname_digits_dots() used by gethostbyname/gethostbyname2. Affected glibc versions include 2.2 up to 2.17; patched in glibc-2.18 and later. Exploitation could allow remote or context-dependent arbitrary code execution depend...

CVE-2011-3268

Technical details about CVE-2011-3268 are not provided in the connected documents; only the initial description is available. Monitor for updates.

CVE-2026-27212

CVE-2026-27212 affects the npm package swiper (versions 6.5.1 through 12.1.1). The vulnerability is a prototype pollution in shared/utils.mjs where indexOf() checks input against forbidden strings; crafted input can pollute Object.prototype via Array.prototype, despite a prior mitigation. This ca...

CVE-2025-2783

A logic error in the Mojo component of Google Chrome on Windows (prior to version 134.0.6998.177 ) allows an incorrect handle to be provided under unspecified circumstances. This vulnerability enables a remote attacker to perform a sandbox escape by interacting with a malicious file , potentially...

CVE-2022-31520

CVE-2022-31520 affects the Luxas98/logstash-management-api repo (up to 2020-05-04). The vulnerability arises from unsafe use of Flask’s send_file, enabling absolute path traversal. This impact is described as partial confidentiality and partial availability (per CVSS metrics). There are no explic...

CVE-2021-2388

CVE-2021-2388 affects Java SE Hotspot and GraalVM Enterprise Edition across several versions (Java SE 8u291, 11.0.11, 16.0.1; GraalVM EE 20.3.2, 21.1.0) and is exploitable via network access with multistream protocols; attacks require user interaction. Multiple connected advisories confirm affect...

CVE-2020-36326

PHPMailer is affected in versions 6.1.8–6.4.0 by an object-injection vulnerability via Phar deserialization when using addAttachment with a UNC pathname. The issue arose after 6.1.8 fixed a UNC-path readability problem, unintentionally removing a block that previously prevented exploitation. Mult...

CVE-2025-48703

CWP (Control Web Panel) versions before 0.9.8.1205 are affected by an unauthenticated remote code execution vulnerability in filemanager/changePerm via shell metacharacters in t_total. Root cause: unsanitized input in t_total enables arbitrary code execution with a non-root user known. Impact is ...

CVE-2023-38572

CVE-2023-38572 concerns WebKitGTK/WebKit components where a website may bypass the Same Origin Policy. The CVE is addressed with updated checks and is fixed in multiple Apple platforms: iOS 15.7.8 and iPadOS 15.7.8; iOS 16.6 and iPadOS 16.6; tvOS 16.6; macOS Ventura 13.5; Safari 16.6; watchOS 9.6...

CVE-2023-3635

CVE-2023-3635 : Okio GzipSource does not handle an exception when parsing a malformed gzip buffer, enabling potential denial of service against Okio-based clients processing crafted GZIP archives. Connected IBM bulletins confirm the vulnerability and reference Okio 2.x usage in IBM products (e.g....

CVE-2022-31313

CVE-2022-31313 affects the PyPI package api-res-py (version 0.1). The vulnerability is a code execution backdoor in the request package, enabling an attacker to execute arbitrary code. Multiple connected sources (Red Hat, Veracode, OSV, GHSA) corroborate a malicious backdoor in the api-res-py ent...

CVE-2019-2758

CVE-2019-2758 affects Oracle MySQL Server, specifically the InnoDB component. Supported affected versions are 5.7.26 and prior, and 8.0.16 and prior. The vulnerability allows a high-privilege attacker with network access to cause a hang or frequent crash (DoS) and may allow unauthorized update, i...

CVE-2019-3855

CVE-2019-3855 is a libssh2 integer overflow in the transport read path that may cause an out-of-bounds write when processing server packets. The issue appears in libssh2 prior to 1.8.1 and could enable code exposure or other impact if a user connects to a malicious SSH server. Connected advisorie...

CVE-2026-20316

Cisco Secure Firewall Management Center (FMC) Software is affected by CVE-2026-20316 due to static credentials in the web interface, enabling an unauthenticated, remote attacker with a low-privileged account to log in and access sensitive data. Root cause: hard-coded/static credentials for a low-...

CVE-2024-57077

The utils-extend library (version 1.0.8 ) is vulnerable to Prototype Pollution via the lib.extend function. An attacker can provide a payload containing an Object.prototype setter to modify properties within the global prototype chain, leading to a denial of service (DoS) . While no specific patc...

CVE-2024-8686

CVE-2024-8686 affects Palo Alto Networks PAN-OS software. A command-injection vulnerability allows an authenticated administrator to bypass system restrictions and run arbitrary commands as root on the firewall. Documentation consistently describes the issue as exploitable by an authenticated adm...

CVE-2021-4235

CVE-2021-4235 describes a denial-of-service risk from unbounded alias chasing in YAML parsing. In connected documents, two Mariner advisories link this CVE to the Go-YAML-based YAML processing used by container tools and specify practical fixes. The Mariner entries note that affected packages are...

CVE-2022-26383

CVE-2022-26383 concerns a UI/UX issue in Firefox and Thunderbird where, after requesting fullscreen, resizing the popup prevented the fullscreen notification from displaying. Connected docs confirm the flaw affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird

CVE-2022-21662

CVE-2022-21662 affects WordPress core; vulnerability allows low-privileged authenticated users (e.g., authors) to execute JavaScript via stored XSS, potentially impacting high-privilege users. It has been patched in WordPress 5.8.3, with older affected versions fixed via security releases back to...

CVE-2020-28196

CVE-2020-28196 affects MIT Kerberos 5 (krb5) prior to 1.17.2 and 1.18.x prior to 1.18.3. The vulnerability stems from unbounded recursion in the ASN.1 BER decoder (lib/krb5/asn.1/asn1_encode.c) due to no recursion limit for indefinite lengths. This can lead to denial of service due to resource ex...

CVE-2019-1003000

A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.49 and earlier (specifically in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java). This flaw allows attackers capable of providing sandboxed scripts to execute arbitrary code on the Jenki...

CVE-2016-9841

CVE-2016-9841 is a vulnerability in zlib 1.2.8 related to improper pointer arithmetic in inffast.c that could have context-dependent impact. Connected advisories confirm public details and show remediation by upgrading zlib to a newer version (e.g., 1.2.11) across affected products and distributi...

CVE-2008-0166

CVE-2008-0166 describes a Debian/Ubuntu OpenSSL PRNG flaw caused by removing seeding steps in md_rand.c, which left the OpenSSL PRNG predictable. Consequently, OpenSSH/OpenSSL keys generated on affected Debian-based systems (2006–2008) could be brute-forced or reproduced. Connected docs indicate ...

CVE-2026-60004

CVE-2026-60004 is a critical RCE in Gitea (and Forgejo ) versions 1.17–1.27.0 (CVSS 9.8). The flaw is in the POST /api/v1/repos/{owner}/{repo}/diffpatch endpoint, where patches are applied in a bare temporary clone whose root is $GIT_DIR. Submitting the same malicious patch twice triggers an add/...

CVE-2022-3996

CVE-2022-3996 describes an OpenSSL policy-contraint processing issue where a malformed certificate policy can trigger a write lock to be taken recursively, enabling DoS for affected processes. The vulnerability is tied to OpenSSL policy checks and the use of policy processing via -policy or X509_...

CVE-2022-41223

The CVE-2022-41223 issue affects the Director database component of Mitel MiVoice Connect (up to 19.3 / 22.22.6100.0). An authenticated attacker can perform a code-injection attack via crafted data due to insufficient restrictions on the database data type. This vulnerability is tracked by CISA a...

CVE-2018-10204

CVE-2018-10204 affects PureVPN 6.0.1 for Windows, via the sevpnclient service when using the OpenVPN protocol. The OpenVPN config at %PROGRAMDATA%\purevpn\config\config.ovpn has write permissions for the Everyone group. An authenticated attacker can modify this file to specify a dynamic library p...

CVE-2018-1050

CVE-2018-1050 is a NULL pointer dereference in Samba’s RPC external printer service that can crash the print spooler, affecting Samba releases from 4.0.0 onward. The issue arises from missing input validation in spoolss RPC calls, leading to a denial-of-service condition. Public advisories and pr...

CVE-2026-60137

WordPress versions 6.8.x before 6.8.6 , 6.9.x before 6.9.5 , and 7.0.x before 7.0.2 are vulnerable to SQL Injection in the author__not_in parameter of WP_Query. This occurs because the component fails to properly sanitize the input, allowing a plugin or theme to pass untrusted data that is concat...

CVE-2025-0291

Summary: CVE-2025-0291 is a Type Confusion in V8 affecting Google Chrome, with exploitation possible via a crafted HTML page to escape the sandbox and execute arbitrary code. The vulnerability is documented across multiple sources, with fixes in Chrome 131.0.6778.264 and related Debian package up...

CVE-2024-37890

The CVE-2024-37890 entry concerns the ws WebSocket library for Node.js. In vulnerable releases, a request containing more headers than server.maxHeadersCount can crash a ws server. The issue has been fixed in [email protected] and backported to [email protected], [email protected], and [email protected]. Remediation/mitigation av...

CVE-2024-30051

CVE-2024-30051 is an Elevation of Privilege in the Windows Desktop Window Manager (DWM) core library dwmcore.dll. The root cause is a heap-based buffer overflow in CCommandBuffer::Initialize caused by a size miscalculation (integer division) that can overflow the heap during a heap spray, allowin...

CVE-2023-47784

CVE-2023-47784 affects the WordPress Slider Revolution Plugin (ThemePunch)

CVE-2021-2166

CVE-2021-2166 affects the MySQL/MariaDB Server: DML component. Public sources in connected documents confirm affected products and versions: MySQL/MariaDB server vulnerable when running on Oracle MySQL 5.7.33 and earlier and 8.0.23 and earlier (per AstraLinux/ALMA advisories and related entries)....

CVE-2020-13949

CVE-2020-13949 affects Apache Thrift versions 0.9.3 through 0.13.0. The issue: malicious RPC clients can send short messages that trigger extremely large memory allocations, leading to a denial of service. The connected advisories confirm a remote DoS risk in Thrift with impact on servers handlin...

CVE-2023-32049

CVE-2023-32049 is a Windows SmartScreen Security Feature Bypass vulnerability. The issue allows an attacker to bypass the Open File - Security Warning prompt by convincing a user to click a specially crafted URL, enabling potential code execution on the affected system. Public sources indicate ac...

CVE-2023-32400

CVE-2023-32400 involves a privacy/entitlements issue where entitlements and privacy permissions granted to an app may be used by a malicious app. The description notes this may enable a malicious actor to exploit granted permissions, and that Apple addressed the issue with improved checks. Affect...

CVE-2022-21638

CVE-2022-21638 affects Oracle MySQL Server (component: Server: Optimizer). Affected: MySQL Server 8.0.29 and earlier. Attack surface: network-accessible via multiple protocols; requires high privileges; can cause a hang or frequent crash (denial of service). Several connected advisories confirm a...

CVE-2022-34534

Digital Watchdog DW Spectrum Server 4.2.0.32842 is affected by CVE-2022-34534 (Information Disclosure). The Nuclei template identifies unauthenticated disclosure via the moduleInformation API endpoint, enabling access to sensitive information such as network configuration, remote addresses, and c...

CVE-2022-26668

CVE-2022-26668 is an ASUS Control Center API broken access-control vulnerability. Connected docs indicate affected product ASUS Control Center, with vulnerable version referenced by CNNVD as v1.4.2.5. The flaw allows an unauthenticated remote attacker to call privileged API functions, enabling pa...

CVE-2019-8526

CVE-2019-8526 is a use-after-free vulnerability in macOS Mojave that could allow a locally authenticated attacker to gain elevated privileges. The issue was addressed with improved memory management and is fixed in macOS Mojave 10.14.4. The CVSS data (3.1) indicates HIGH impact on confidentiality...

CVE-2017-16995

CVE-2017-16995 is a sign-extension defect in the Linux kernel's eBPF verifier (kernel/bpf/verifier.c) that can be triggered via BPF syscall, allowing a local user to escalate privileges or affect memory/behavior. Public writeups and Arch security advisories indicate the issue affects kernels prio...

CVE-2024-21302

Microsoft has fixed CVE-2024-21302 for Windows systems with Virtualization-Based Security (VBS). The elevation-of-privilege vulnerability allowed an administrator to replace current Windows system files with older versions, potentially reintroducing mitigated VBS vulnerabilities and exfiltrating ...

CVE-2023-29409

CVE-2023-29409 affects the Go language runtime/package (golang) across multiple distributions. The issue arises from extremely large RSA keys in certificate chains causing excessive signature verification CPU usage; the fix restricts RSA key sizes in handshakes to 8192 bits. Public advisories ind...