377973 matches found
CVE-2026-44178
Technical details are not publicly available in the provided documents. Monitor for updates from vendors and advisories regarding CVE-2026-44178 (xrdp heap-based overflow; fixed in 0.10.6.1).
CVE-2026-50743
CVE-2026-50743 : Revive Adserver 6.0.7 contains a CSRF in the zone-include.php script that allows linking/unlinking banners or campaigns to zones via crafted GET/POST requests without CSRF token verification, enabling actions on behalf of an authenticated admin. Affected: Revive Adserver up to an...
CVE-2026-55645
CVE-2026-55645 affects xrdp (open source RDP server). The vulnerability is an out-of-bounds read in the processing of Client Control PDUs during the RDP connection sequence, caused by insufficient length validation in the parser before reading data from the network stream. This can allow a remote...
CVE-2026-47276
CVE-2026-47276 affects NanoMQ up to version 0.24.11: a NULL pointer dereference in properties_parse() when processing user_properties, allowing an authenticated attacker to crash the broker by sending a crafted POST to /api/v4/mqtt/publish with user_properties as a JSON array (strlen on a NULL it...
CVE-2026-42218
CVE-2026-42218 affects xrdp, an open source RDP server. The issue is a timing side‑channel in the login interface of versions 0.10.6 and earlier that allows remote observers to infer whether a username exists, enabling information disclosure via username enumeration. The vulnerability is explicit...
CVE-2026-47275
Nanomq has a NULL pointer dereference in nni_mqttv5_msg_decode_connect() (mqtt_codec.c:1863) for versions ≤ 0.24.11. The code iterates CONNECT properties using prop instead of will_prop; when a packet has no connect-level properties but has will properties, dereferencing prop->next can SIGSEGV...
CVE-2026-41521
CVE-2026-41521 affects xrdp (0.10.6 and prior) in the vnc-any connection mode. A crafted screen update image can trigger an integer overflow during memory buffer size calculation, causing an undersized allocation and an out-of-bounds read on incoming image data. Consequences include potential inf...
CVE-2026-35217
CVE-2026-35217 affects NanoMQ (MQTT v5) where a SUBSCRIBE packet can be processed even when the final 1-byte Subscription Options field is missing. A specific packet-length construction reveals two manifestations of a single parsing defect: (1) the broker may accept the malformed subscription and...
CVE-2026-58482
In Network-AI, the ApprovalInbox HTTP surface (lib/approval-inbox.ts) exposes state-changing endpoints POST /approvals/:id/approve and /deny without authentication and with Access-Control-Allow-Origin: * across all routes. This allows any reachable actor to enumerate and approve high-risk actions...
CVE-2026-46701
Summary (markdown): Network-AI’s MCP SSE server defaults to an empty secret prior to v5.4.5, causing _isAuthorized to return true for all requests and enabling unauthenticated cross-origin tool calls. The server also unconditionally sets Access-Control-Allow-Origin: *, allowing browser contexts t...
CVE-2026-58481
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, AgentRuntime allowed reading/listing files outside the configured sandbox basePath due to path containment checks that used raw string prefix tests. A base like /tmp/network-ai-sandbox could be confused with a s...
CVE-2026-41252
Summary: CVE-2026-41252 affects xrdp up to v0.10.6. It describes a heap-based buffer overflow in the vnc-any mode, caused by an out-of-bounds write when processing RFB color map messages. A malicious VNC server can craft color indices to trigger this, leading to DoS or potentially remote code exe...
CVE-2026-58414
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Before v5.12.2, EnvironmentManager.backup() recursively collected files via _collectBackupFiles(), which used statSync and followed symlinks. If data/ contained a symlink to a directory outside the environment root, backup recursion cou...
CVE-2026-64207
The CVE-2026-64207 entry concerns the Linux kernel net/sched DualPI2 handling of GSO: when a GSO skb is split into N segments, the code previously propagated N extra packets to the parent, causing the parent’s qlen to exceed the number of queued packets. Under QFQ, after real packets dequeue, a l...
CVE-2026-64205
CVE-2026-64205 concerns the Linux kernel i2c-i801 driver. The issue stems from an unconditional hardware register cleanup in the error path of i801_access() when i801_check_pre() fails (e.g., -EBUSY). This can bypass ownership of the SMBus controller, yet code proceeds to clear INUSE_STS and rese...
CVE-2026-64206
Summary of CVE-2026-64206 : In the Linux kernel Bluetooth L2CAP subsystem, teardown can deadlock due to a circular lock between l2cap_conn_del() and process_pending_rx(). Specifically, l2cap_conn_del() takes conn->lock and then cancels pending_rx_work, while process_pending_rx() may contend fo...
CVE-2026-64192
The CVE-2026-64192 issue affects the Linux kernel BPF inode storage maps: when BPF_LSM is compiled in but not boot-enabled, lsm_prepare() may not run, leaving bpf_lsm_blob_sizes.lbs_inode uninitialized. As a result, privileged creation/update of BPF_MAP_TYPE_INODE_STORAGE can misaddress inode->...
CVE-2026-64191
The CVE-2026-64191 issue affects the Linux kernel i2c-stub driver (CONFIG_I2C_STUB=m) where I2C_SMBUS_I2C_BLOCK_DATA did not validate data->block[0] against I2C_SMBUS_BLOCK_MAX, allowing out-of-bounds access when an I2C_SMBUS_IOCTL with a block length > 32 is issued. The bug contrasts with ...
CVE-2026-64190
The CVE-2026-64190 entry describes a Linux kernel race in net: team where __team_change_mode() clears team->ops with memset() while a concurrent team_xmit() under RCU can read ops.transmit and call a NULL pointer, causing a kernel NULL pointer dereference. It requires a mode change (CAP_NET_AD...
CVE-2026-64188
CVE-2026-64188 is a Linux kernel vulnerability in the Qualcomm rmnet path where rmnet_dellink() frees an endpoint with kfree() while RCU readers may still reference ep->egress_dev, causing use-after-free and potential kernel crash. The fix adds an rcu_head to struct rmnet_endpoint and replaces...
CVE-2026-64189
CVE-2026-64189 affects the Linux kernel netfilter ipset dump path. A race between dump and ip_set_list resize allows a use-after-free when a concurrent ip_set_create() grows the array and the old one is freed before it is fully dereferenced. The advisory notes that the dump code reads inst->ip...
CVE-2026-64187
CVE-2026-64187 affects the Linux kernel’s XFS log recovery. If the first operation of a transaction is a bare header (len == sizeof(struct xfs_trans_header)) and xlog_recover_add_to_trans() adds an item with no region (ri_buf is NULL), the item can stay on r_itemq with ri_cnt == 0. During recover...
CVE-2026-35048
The CVE affects the Piwigo installer (versions 16.3.0 and earlier) where POST parameters for database configuration are written directly into local/config/database.inc.php without proper sanitization. The issue arises because on PHP 8+, addslashes() no longer provides protection after get_magic_q...
CVE-2026-58413
CVE-2026-58413 affects Network-AI (TypeScript/Node.js) where, before v5.12.2, EnvironmentManager.restore(env, backupId) builds a backup path with join(envDir, '.backups', backupId) and only checks that this path exists. This allowed path traversal like ../../../outside/source-dir to copy files fr...
CVE-2026-35591
CVE-2026-35591 concerns libvips' TIFF decoding via the tiffload path. The issue arises when processing a TIFF image containing a JPEG/JPEG2000-encoded tile, where the number of channels could be mis-determined, enabling a possible heap-based buffer overflow. Affected versions are libvips ≤ 8.18.1...
CVE-2026-54051
Network-AI (TypeScript/Node.js) prior to 5.9.1 is vulnerable: the agent sandbox gates shell commands via an allowlist, but ShellExecutor runs commands through /bin/sh -c. Wildcards like git *, npm *, or node * can match unintended strings (e.g., git status; …), enabling arbitrary code execution i...
CVE-2026-35590
CVE-2026-35590 affects libvips’ EXIF decoder. Versions
CVE-2026-33328
CVE-2026-33328 affects libvips, a fast image processing library. On 32-bit systems, versions up to and including 8.18.0 allow the GIF decode path (gifload) to miscompute image dimensions, potentially triggering an integer overflow. The issue is resolved in version 8.18.1. Impact details in the so...
CVE-2026-33327
CVE-2026-33327 affects the libvips image processing library. The vulnerability is in the vipsload operation for versions
CVE-2026-32825
dataCycle-CORE (dataCycle data management system) before version 26.06.08 contains a password-guessing vulnerability: it enables Devise’s lockable module but disables lock/unlock strategies and lacks rate limiting, allowing unlimited login attempts on both the browser (/users/sign_in) and API (/a...
CVE-2026-32824
The CVE affects dataCycle-CORE (dataCycle data management system). Before and including version 25.07.3, a low-privileged authenticated API user could supply forwardToUrl and redirectUrl during password reset/confirmation flows, which were embedded into outgoing emails without host allowlisting. ...
CVE-2026-32823
Summary: CVE-2026-32823 affects dataCycle-CORE (dataCycle data management system). Prior to version 26.06.08, the module handling core processing and framework rules exposed server-side state changes via GET routes. Because browsers send cookies on same-site top-level navigation and Rails does no...
CVE-2026-32821
CVE-2026-32821 affects dataCycle dataCycle-CORE prior to 26.06.08. An authenticated API user with a valid access token can use user_email to have the collection API evaluate permissions as another user, potentially exposing that user’s collections. In V4, if a collection id is known, the add_item...
CVE-2026-32806
CVE-2026-32806 affects dataCycle-CORE prior to version 26.06.08, where an authenticated user can abuse /remote_render to request arbitrary partials or helper-backed render functions, bypassing controller authorization and exposing admin content (e.g., PostgreSQL dashboard stats) that should be re...
CVE-2026-32820
Summary: CVE-2026-32820 affects the dataCycle-CORE module of dataCycle. Before and including v25.07.3, the docs/static Markdown renderer accepts attacker-controlled path segments and passes them through Rails HTML sanitizer, which fails to remove directory traversal sequences. An unauthenticated ...
CVE-2026-32819
dataCycle-CORE prior to and including version 25.07.3 contains a vulnerability where a Standard user can enumerate other users’ names and e-mail addresses via /users/search despite restricted access. This results in leakage of internal staff addresses, full names, and the existence of guest/exter...
CVE-2026-46671
This CVE concerns the Rust-based onenote_parser. Prior to version 1.1.1, a crafted .onetoc2 file could cause Parser::parse_notebook to open files outside the notebook directory by joining entry names with the notebook base, without ensuring relative paths. The issue allows file-existence probing ...
CVE-2026-63429
HeyForm is an open-source form builder with a vulnerable endpoint: before 3.0.0-rc.9, POST /api/upload has no authentication, guards, form-context validation, openToken requirement, or session cookie check. Any anonymous internet user can upload various file types (up to 10 MB) and receive a perm...
CVE-2026-63428
Summary: HeyForm (open-source form builder) prior to 3.0.0-rc.9 stores submitter-supplied hiddenFields unvalidated, allowing an anonymous submitter to inject arbitrary key/value data into submission.hiddenFields. Those fields are forwarded to every webhook integration registered on the form, enab...
CVE-2026-35198
HeyForm (open-source form builder) is affected by a stored XSS vulnerability present before version 3.0.0-rc.7. A low-privileged team member can inject malicious JavaScript that executes when a team owner views the form, enabling complete account takeover through privilege escalation. A fix is av...
CVE-2026-45797
CVE-2026-45797 affects HeyForm (open-source form builder). Before version 3.0.0-rc.7, the /api/upload endpoint allowed unauthenticated file uploads, including SVGs. Uploaded SVGs are stored in the static assets directory and served with Content-Type: image/svg+xml by Express’s serve-static middle...
CVE-2026-46428
CVE-2026-46428 affects the Rust mailer library lettre. Versions 0.10.1 through before 0.11.22 using the boring-tls backend have an inverted-boolean bug that silently disables TLS hostname verification under the default strict configuration. An on-path attacker presenting any chain-valid certifica...
CVE-2026-32822
Technical details are not publicly available in the provided documents. No specific affected versions, vulnerable components, or fixes are disclosed here. Monitor for updates.
CVE-2026-32807
CVE-2026-32807 affects dataCycle-CORE prior to 25.07.3, where any user with a DataLink UUID can fetch an attached text file directly, even if expired or unauthenticated. The route is public and mailers embed the direct URL, allowing leaked or forwarded links to expose the attachment. Impact is co...
CVE-2026-63102
rConfig Core before 8.2.8 contains a privilege-escalation flaw in the Users API: authenticated users can mass-assign the Admin role by submitting an unvalidated role field during user creation or profile updates. The issue stems from missing allowlist validation and the absence of an admin-level ...
CVE-2026-28220
CVE-2026-28220 concerns the Wazuh Cluster Distributed API (DAPI). Before version 4.14.5, the master node could be coerced to deserialize an attacker-controlled callable and run it under an attacker-controlled RBAC context due to a permissive as_wazuh_object() deserialization and client-supplied r...
CVE-2026-6793
CVE-2026-6793 affects Q-smart NexT Poll by Bifra Engineering Consulting Ltd. The flaw is improper neutralization of input during web page generation, enabling Stored XSS in pages generated before version 1.8.7. CVSS 3.1 base score 5.4 (Medium) with NETWORK impact, LOW privileges, UI required, and...
CVE-2026-27823
CVE-2026-27823 affects EGroupware. The issue arises from improper authorization checks in SmallPartMediaRecorder::ajax_upload, combined with a file write primitive and an arbitrary file read vulnerability, enabling an authenticated attacker to upload to a controllable path, read sensitive files (...
CVE-2026-46415
The CVE-2026-46415 issue affects the Caddy Defender plugin for Caddy, prior to version 0.10.1. Defender evaluated blocking decisions using r.RemoteAddr (the immediate peer), which could be a trusted proxy in deployments behind proxies/CDNs/load balancers, allowing clients from blocked IP ranges t...