412624 matches found
CVE-2026-111279 Dragonfly through 2.0.2 Unbounded Memory Allocation via Negative COUNT in HRANDFIELD, ZRANDMEMBER and SRANDMEMBER
Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD, ZRANDMEMBER or SRANDMEMBER. Attackers can send a single command against a one-element key with a huge negative COUNT to...
CVE-2026-111278 NivoCart through 2.5.1 CAPTCHA Bypass via Answer Disclosed in Page HTML
NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protection because the expected code is printed as plain text in the HTML. Attackers can fetch protected forms, extract the captchaimage value with a pattern match, and submit it to...
CVE-2026-111277 NivoCart through 2.5.1 Guest Order Invoice Disclosure via account/order/download
NivoCart through 2.5.1 contains a missing authorization vulnerability in the download action of account/order that allows unauthenticated attackers to retrieve guest order invoices by supplying an orderid. Attackers can iterate the orderid parameter, which matches guest orders stored with...
CVE-2026-111275 nifti_clib through 3.0.1 Stack Out-of-Bounds Access via nifti_convert_n2hdr2nim
nifticlib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifticonvertn2hdr2nim because the NIfTI-2 dim0 value is never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header read via niftiimageread to crash applications or corrupt stack memory...
CVE-2026-111274 unarr through 1.1.1 Heap Out-of-Bounds Read via zip_parse_extra_fields
unarr through 1.1.1 contains a heap-based out-of-bounds read in zipparseextrafields in zip/parse-zip.c due to an incorrect ZIP64 extra field length check. Attackers can supply a crafted ZIP archive with 0xFFFFFFFF sentinel values and a truncated ZIP64 record to read past the heap buffer and crash...
CVE-2026-111272 LibRaw through 0.22.2 Heap Out-of-Bounds Read via parseNikonMakernote ShotInfo
LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseNikonMakernote that allows attackers to read past a short ShotInfo buffer. Attackers can supply a crafted Nikon NEF/TIFF with a 5-byte ShotInfo tag declaring version 243 to crash applications decoding the image...
CVE-2026-111273 unarr through 1.1.1 Off-by-One Heap Buffer Overflow via tar_get_name
unarr through 1.1.1 contains an off-by-one heap-based buffer overflow in targetname in tar/parse-tar.c, reachable through the arentrygetname API. Attackers can supply a crafted TAR archive with a full ustar prefix and name to write a NUL byte past the allocation, corrupting heap memory and crashi...
CVE-2026-111271 libmodplug through 0.8.9.1 Heap Out-of-Bounds Read via CSoundFile::ReadAMS2
libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::ReadAMS2 in src/loadams.cpp that allows attackers to read adjacent heap memory via crafted AMS files. Attackers can supply an AMS module whose pattern effect bytes keep bit 7 set, driving the decoder...
CVE-2026-111270 libmodplug through 0.8.9.1 Heap Out-of-Bounds Write via CSoundFile::ReadDSM
libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM in src/loaddsm.cpp because nPat is never checked against MAXPATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping pattlen value to corrupt heap memory and crash the...
CVE-2026-111269 libical through 4.0.6 Heap Out-of-Bounds Read via icalvalue_decode_ical_string
libical through 4.0.6 contains a heap-based out-of-bounds read in icalvaluedecodeicalstring in src/libical/icalvalue.c when decoding input ending in a backslash. Attackers can supply escaped iCalendar text with a trailing backslash, causing the loop to read past the terminator and crash the...
CVE-2024-58397 MP4v2 through 2.1.3 Heap Out-of-Bounds Read via MP4File::GetChapters
MP4v2 through 2.1.3 contains a heap-based out-of-bounds read in MP4File::GetChapters that allows attackers to read past heap allocations via crafted QuickTime chapter samples. Attackers can supply an MP4 file whose chapter sample is shorter than its declared title length, crashing applications li...
CVE-2026-94135 Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default
The Apache Airflow SFTP provider's deferrable code paths SFTPTrigger, SFTPHookAsync, SFTPClientPool disable SSH host-key verification by default unless the connection explicitly sets nohostkeycheck to false. Deployments that run SFTP sensors or operators in deferrable mode are affected. An attack...
CVE-2026-96806 Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token
The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but KeycloakJWTMiddleware then issued a new, unrevoked token on the same response, so the user stayed logged in. Deployments using the Keycloak auth manager are affected: afte...
CVE-2026-94134 Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default
The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless hostkey is configured or nohostkeycheck is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position...
CVE-2026-92228 Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read
The Apache Airflow Keycloak provider's multi-team provisioning attachteampermissions granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team...
CVE-2026-109468 ASP.NET Core Denial of Service Vulnerability
...
CVE-2026-108454 Microsoft Office PowerPoint Information Disclosure Vulnerability
...
CVE-2026-108455 Microsoft Office PowerPoint Information Disclosure Vulnerability
...
CVE-2026-108452 Microsoft Office SharePoint Remote Code Execution Vulnerability
...
CVE-2026-108453 Microsoft Office PowerPoint Information Disclosure Vulnerability
...
CVE-2026-108450 Microsoft Office Word Remote Code Execution Vulnerability
...
CVE-2026-108451 Microsoft Office Word Remote Code Execution Vulnerability
...
CVE-2026-108449 Microsoft Office Word Remote Code Execution Vulnerability
...
CVE-2026-108446 Microsoft Office Excel Remote Code Execution Vulnerability
...
CVE-2026-108448 Microsoft Office Outlook Remote Code Execution Vulnerability
...
CVE-2026-108447 Microsoft Office Word Remote Code Execution Vulnerability
...
CVE-2026-108445 Microsoft Office Word Remote Code Execution Vulnerability
...
CVE-2026-108443 Microsoft Office Word Remote Code Execution Vulnerability
...
CVE-2026-108444 Microsoft Office Remote Code Execution Vulnerability
...
CVE-2026-108441 Microsoft Office Word Remote Code Execution Vulnerability
...
CVE-2026-108442 Microsoft Office Word Remote Code Execution Vulnerability
...
CVE-2026-108439 Microsoft Office Word Remote Code Execution Vulnerability
...
CVE-2026-108440 Microsoft Office Word Remote Code Execution Vulnerability
...
CVE-2026-108438 Microsoft Office Word Information Disclosure Vulnerability
...
CVE-2026-108437 Microsoft Office Word Remote Code Execution Vulnerability
...
CVE-2026-108435 Microsoft Office Word Information Disclosure Vulnerability
...
CVE-2026-108436 Microsoft Office Word Information Disclosure Vulnerability
...
CVE-2026-108434 Microsoft Office Word Information Disclosure Vulnerability
...
CVE-2026-108433 Microsoft Office Word Security Feature Bypass Vulnerability
...
CVE-2026-108432 Microsoft Office Word Remote Code Execution Vulnerability
...
CVE-2026-108431 Microsoft Office Word Remote Code Execution Vulnerability
...
CVE-2026-108428 Microsoft Office Word Remote Code Execution Vulnerability
...
CVE-2026-108430 Microsoft Office Word Remote Code Execution Vulnerability
...
CVE-2026-108429 Microsoft Office Word Remote Code Execution Vulnerability
...
CVE-2026-108427 Microsoft Office Word Remote Code Execution Vulnerability
...
CVE-2026-108426 Microsoft Office Word Remote Code Execution Vulnerability
...
CVE-2026-111357
Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026...
CVE-2026-105040 EnergizeLab Eilik User-ID Mass Assignment Account Takeover
The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests mass assignment. A registered user can set another account's identifier and take over that account...
CVE-2026-105039 EnergizeLab Station Middleware Admin APIs Missing Role Checks
EnergizeLab station-middleware NestJS Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents...
CVE-2026-105038 EnergizeLab Eilik Unauthenticated AI Model Administration and Runtime Model Switching
The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticated remote attacker can change AI model configuration and switch the model in use at runtime...