379222 matches found
CVE-2026-71478
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-66808
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-71476
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-71439
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-71438
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-50159
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-71437
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-71436
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-64638
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-71435
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-71434
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-64662
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-64663
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-64665
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-64664
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-71433
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-7366
Technical details for CVE-2026-7366 are not publicly available in the provided documents. No affected products, vectors, or remediation are described. Monitor for updates as new details are published.
CVE-2026-71325
Traefik Kubernetes CRD provider contains a cross-namespace isolation bypass for TraefikService references using the @kubernetescrd form (e.g., victim-backend@kubernetescrd) when allowCrossNamespace is false. The root cause is in nameAndService: for names containing @, the guard that prevents cros...
CVE-2026-71327
Traefik Gateway API provider in Traefik v3.x is vulnerable to an identity collision when constructing HTTPRoute/GRPCRache identities by hyphen-concatenating namespace, route name, Gateway identity, entrypoint, and rule index. This non-injective key can cause two distinct Routes with matching rule...
CVE-2026-71326
Traefik (v3.6.x and v3.7.x) suffers a BasicAuth middleware vulnerability where concurrent password checks are deduplicated by a singleflight group using a key composed of password + secret. If an attacker has a valid credential and can read the stored hash, they can craft requests with an unconfi...
CVE-2026-71324
Summary: CVE-2026-71324 is associated with Traefik’s default HTTP reverse proxy, enabling unauthenticated cross-user response poisoning via proxied CONNECT requests on a shared backend keep-alive pool. When a client uses an HTTP/2 or HTTP/3 CONNECT, Traefik forwards the CONNECT body through a sha...
CVE-2026-43622
CVE-2026-43622 affects llama.cpp builds b1886–b7445, where the LLaMA-Android JNI wrapper presents a double free vulnerability. The code allocates memory with malloc() in new_1batch() but frees it with the C++ delete operator in free_1batch(), leading to heap metadata corruption. Consequences desc...
CVE-2026-53985
CVE-2026-53985 affects Ground Station prior to version 0.6.0. It describes an unauthenticated denial-of-service in the Socket.IO server’s service_control event handler, allowing an unauthenticated network peer to forcibly terminate the ground-station process by sending a restart_service command. ...
CVE-2026-5423
The CVE affects @neo4j/graphql library prior to 7.5.6 (and 7.5.x) where a pre-decoded JWT passed via GraphQL subscription connectionParams is not verified, allowing unauthenticated clients to forge JWT claims and trigger @authentication/@subscriptionsAuthorization checks to receive restricted sub...
CVE-2026-18258
CVE-2026-18258 affects Scripta/eScriptorium up to version 26.04.1, impacting the Line, LineTranscription, VirtualCollection, tag and process API endpoints. The root cause is authorization bypass where a remote authenticated user can read, modify, and delete other users’ transcription content. Thi...
CVE-2026-18277
Technical details about CVE-2026-18277 are not publicly available in the provided documents. Monitor for updates from the vendor and CVE records.
CVE-2026-18359
CVE-2026-18359 affects Scripta eScriptorium (through 26.04.1) via SSRF in METS and IIIF import URI handling. A remote authenticated user can trigger the server to issue arbitrary HTTP requests to internal hosts (including cloud instance metadata) by supplying mets_uri or iiif_uri in POST /api/doc...
CVE-2026-18275
CVE-2026-18275 affects Scripta eScriptorium (up to version 26.04.1). An authorization bypass lies in the process and annotation taxonomy serializers, enabling a remote authenticated user to perform segmentation and transcription against other users’ document parts, overwriting content. The root c...
CVE-2026-18276
CVE-2026-18276 affects Scripta eScriptorium prior to 26.04.1 due to missing authorization in the websocket consumer. A remote authenticated user can subscribe to any document’s event stream and observe another user’s segmentation, transcription, import, export, and training activity by manipulati...
CVE-2026-3430
CVE-2026-3430 affects the Creative Mail WordPress plugin versions 1.6.5–1.6.9. The issue is an unauthenticated SQL injection caused by not sanitizing/escaping a parameter before use in an SQL statement when handling abandoned cart emails. CVSS 3.1 metrics (from WPScan) indicate NETWORK attack vec...
CVE-2026-19047
The CVE covers NocteDefensor LudusMCP up to 1.0.24. The vulnerability resides in the function executeArbitraryCommand/executeCommand within src/ludusMCP/cliWrapper.ts of the ludus_cli_execute component, where manipulating the command/args enables a command injection. This is described as a LOCAL ...
CVE-2026-18427
CVE-2026-18427 affects @fastify/static prior to version 10.1.3. The patch left gaps in path canonicalization: dot segments, encoded dots, duplicate slashes, and backslashes were not normalized before route matching or serving, enabling an unauthenticated bypass of route-based guards for a protect...
CVE-2026-68750
CVE-2026-68750 affects the html_sanitize_ex crate (versions 0.3.1 up to, but not including, 1.5.3). The vulnerability is a quadratic-time CPU/memory exhaustion in the HTML traversal engine when sanitizing large sibling lists; the traverser recurses on the tail and repeatedly flattens lists, causi...
CVE-2026-68749
The vulnerability CVE-2026-68749 affects the html_sanitize_ex Ruby gem (versions before 1.5.3; affected range includes 0.3.1–1.5.2). It stems from an inefficient greedy regex in HtmlSanitizeEx.Scrubber.CSS.scrub/1 that backtracks on long CSS declarations, causing quadratic CPU consumption and pot...
CVE-2026-68747
Technical details about CVE-2026-68747 are not publicly provided in the supplied documents. No information on affected versions, exploit vectors, or fixes is available here. Monitor for updates from the referenced advisories.
CVE-2026-66829
The CVE concerns html_sanitize_ex (rrrene) with a flaw in html5 scrubber output: attacker-supplied elements are not sanitized, enabling an Open Redirect by navigating the whole document to an attacker-chosen site. The vulnerability affects html_sanitize_ex versions prior to 1.5.3 (from 0.3.1 up to
CVE-2026-66370
The CVE concerns html_sanitize_ex (rrrrene) where the HTML5 scrubber fails to validate scheme on form-related attributes, allowing an unauthenticated remote attacker to retarget an existing form on a rendering page and capture submitted data via input form and formaction attributes. No new form c...
CVE-2026-66843
The vulnerability CVE-2026-66843 affects html_sanitize_ex: from 0.3.1 before 1.5.3. The HTML5 scrubber does not register the tag in allow_tag_with_uri_attributes/3, and its only guard is a prefix check on javascript:, allowing attacker-supplied data: URLs to reach a trusted page via the data att...
CVE-2026-19046
CVE-2026-19046 affects NocteDefensor LudusMCP (up to 1.0.24). The vulnerable element is an unknown function in src/tools/ludusEnvironmentGuidesSearch.ts of the ludus_environment_guides_search component. According to the description, manipulating the guide_name argument enables path traversal, wit...
CVE-2026-53977
OpenChamber 1.11.7 contains an unauthenticated DoS vulnerability via POST to /api/system/shutdown, triggered because the shutdown route is registered before authentication middleware in bootstrap-runtime.js. This allows remote attackers to terminate the server process and disrupt all active AI co...
CVE-2026-70646
CVE-2026-70646 concerns the aiosend Crypto Pay API client. Before version 3.0.7, WebhookHandler.feed_update() deserializes the entire request body prior to HMAC verification, enabling an unauthenticated attacker to trigger expensive JSON parsing and cause CPU/memory exhaustion (pre-auth DoS). The...
CVE-2025-49506
APR-util versions 1.6.3 and earlier expose a timing-side-channel vulnerability in apr_password_validate(), leaking information about hashes or passwords on platforms lacking crypt() (Windows, BeOS, NetWare, Android). The issue is fixed in version 1.6.4. Affected component: APR-util password valid...
CVE-2026-32327
CVE-2026-32327 affects APR-util 1.6.3 and earlier. A stack recursion flaw occurs when parsing XML from untrusted sources via apr_xml_quote_elem(), potentially causing a crash. Upgrading to APR-util 1.6.4 is recommended and fixes the issue. The available sources describe the vulnerability and the ...
CVE-2026-34191
CVE-2026-34191 is an SQL injection vulnerability in the Apache Portable Runtime Utility via the apr_dbd_oracle provider. Affected versions are APR Utility 1.6.0 through 1.6.3. The connected documents confirm the vulnerability type and affected range but do not provide exploit details or remediati...
CVE-2026-34501
CVE-2026-34501 describes a heap-based buffer overflow in the APR Redis client component of Apache Portable Runtime Utility (versions 1.6.0–1.6.3 ). The issue, documented across multiple sources (NVD, CVE List, EUVD), indicates that upgrading to version 1.6.4 resolves the vulnerability. No exploit...
CVE-2026-34502
CVE-2026-34502 describes a heap-based buffer overflow in the Apache Portable Runtime Utility memcached client, affecting APR Utility versions 1.3.0 through 1.6.3. The available documents identify the vulnerability type and affected version range but do not specify the exact root cause, vulnerable...
CVE-2026-19045
NocteDefensor LudusMCP up to version 1.0.24 is affected. The vulnerability resides in the function SecretDialog.showSecretDialog of the file src/utils/secretDialog.ts in the component get_credential_from_user . The issue stems from a manipulation of the argument Description that enables command i...
CVE-2026-66711
CVE-2026-66711 concerns a Cross Site Scripting (XSS) vulnerability in the WordPress plugin WooCommerce Multilingual & Multicurrency, affecting versions up to and including 5.5.6. The connected documents confirm the affected product and the XSS vulnerability type but do not provide technical explo...