66208 matches found
CVE-2026-80595
In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - add response length checks The driver processes response data from device buffers without verifying that the device actually sent enough data. This can lead to out-of-bounds reads or processing stale data. Add...
CVE-2026-80594
In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing The driver parses CDC union descriptors in imspcugetcdcuniondesc by iterating through the extra descriptor data. However, it does not verify that the...
CVE-2026-80592
In the Linux kernel, the following vulnerability has been resolved: samples/damon/mtier: fail early if address range parameters are invalid The comment on top of struct damonregion clearly says that For any use case, @ar should be non-zero positive size. which is now verified in...
CVE-2026-80593
In the Linux kernel, the following vulnerability has been resolved: hwmon: asusatk0110 Check package count before accessing element atkecpresent walks the management group package returned by the GGRP ACPI method and, for each sub-package, reads its first element: id = &obj-package.elements0; if...
CVE-2026-80591
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix listxattr handling of corrupted xattr entries Validate the xattr entry before reading its fields in f2fslistxattr. Return -EFSCORRUPTED when the entry is outside the valid xattr storage area instead of returning a...
CVE-2026-80590
In the Linux kernel, the following vulnerability has been resolved: inet: frags: strip GSO state from fragments before reassembly A virtionethdr tun/tap, or AFPACKET with PACKETVNETHDR can mark an IPv4 or IPv6 fragment as GSO; nothing relates gsotype to fragoff...
CVE-2026-38822
In openNDS before 11.0.0, the clientparams.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by...
CVE-2026-38821
A heap-based buffer overflow vulnerability exists in openNDS before 11.0.0 that allows an unauthenticated attacker on the captive portal network to crash the openNDS daemon denial of service and potentially achieve remote code execution. This is in httpmicrohttpd.c...
CVE-2026-38820
openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /openndspreauth/ endpoint because of libopennds.sh...
CVE-2026-38819
Multiple memory leaks in openNDS before 11.0.0 allow an unauthenticated attacker on the captive portal network to exhaust all available memory on the device within minutes...
CVE-2026-37236
grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...
CVE-2026-82072
Out of bounds read in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-81498
GHSA-m3j6-p3v3-qmjv: Container configuration newline injection through nvidia.driver.capabilities...
CVE-2026-81494
GHSA-7fj9-65v4-rp7h: Arbitrary file write on host via image-planted symlinks and oci.dns. newline injection...
CVE-2026-81497
GHSA-4qxq-p5hm-3q3p: Arbitrary host file read+write via VM template path traversal...
CVE-2026-81496
GHSA-26gp-p5fw-3r2h: Arbitrary file write on host via path traversal in instance backup import...
CVE-2026-81493
GHSA-p2v3-6wvc-cv3p: Arbitrary file write on host via image fingerprint path traversal...
CVE-2026-81495
GHSA-67qw-68v3-36h6: Arbitrary file write on host via path traversal in custom volume import...
CVE-2026-81499
GHSA-6v6x-387m-rj4w: Project restriction bypass on network address sets...
CVE-2026-77358
cpp-httplib is a C++ header-only HTTP/HTTPS library. In versions 0.33.0 through 0.50.0, the TLS-enabled WebSocket client frees the TLS session before closing the WebSocket that still uses it, producing a use-after-free. In WebSocketClient::shutdownandclose the SSL object is freed and the pointer...
CVE-2026-77341
cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes trailer header names and values directly to the socket without validating them, allowing CRLF sequences in a trailer field to inject additional headers or split the HTTP respons...
CVE-2026-80179
A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption JWE token containing numerous period delimiters. This malformed token can force the JWE.deserialize function to allocate excessive memory, leading to a MemoryError. This issue results in a denial of...
CVE-2026-54330
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway RGW SigV4 handler does not reject requests that carry x-amz- headers absent from the signed header set, allowing anyone holding a presigne...
CVE-2026-50152
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user with only mon allow r capabilities to...
CVE-2026-39944
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the RADOS Gateway RGW protects STS session tokens with an AES-128-CBC handler that provides no message authentication, allowing an attacker who holds any valid ST...
CVE-2025-30156
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the CephX authentication protocol encrypts tickets with AES-128-CBC in an unauthenticated mode that uses a hard-coded initialization vector and no message...
CVE-2026-76060
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec, allowing any authenticated user with View Events permission to execute arbitrary operati...
CVE-2026-81934
Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server...
CVE-2026-18374
Passing an effectively empty string to the ,ccs= syntax extension of the mode argument in the fopen function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in...
CVE-2026-81893
A flaw was found in gdk-pixbuf. When loading a specially crafted JPEG image containing chunked ICC profile markers, an error during ICC profile parsing can leave stale size metadata after the profile buffer is freed. A subsequent allocation in the same decode can cause an out-of-bounds write,...
CVE-2026-81525
Removed by vendor...
CVE-2026-81524
A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application that incorporates untrusted input into these name components can have...
CVE-2026-81523
A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of...
CVE-2026-81522
A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed at a different...
CVE-2026-81521
The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name...
CVE-2026-59314
Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spri...
CVE-2026-59313
Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49...
CVE-2026-59283
Applications that evaluate Spring Expression Language SpEL expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring...
CVE-2026-59282
Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service DoS attack. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framewo...
CVE-2026-59281
Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors or Errors.getFieldError accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in...
CVE-2026-59280
Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader. Spring Framework 7.0.0 - 7.0.8 Spring...
CVE-2026-5680
A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate negotiated. This could lead to excessive memory consumption due to the PerMessageDeflateFunction.largerBuffer method using exponential doubling,...
CVE-2026-78002
A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript replace function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during string replacement, causing memory...
CVE-2026-81727
NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incrdownload methods that allows attackers to overwrite files outside the install root through pre-existing hardlinks. Attackers with write access to a shared downloader...
CVE-2026-81726
NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagge...
CVE-2026-81725
NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with many unmatched opening tags. Attackers can exploit lazy regex patterns in the readblock method...
CVE-2026-81724
NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial of service by supplying deeply nested feature-structure input. Attackers can craft trivial payloads with nested brackets that exceed...
CVE-2026-81723
NLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView.readxmlfragment that rescans accumulated XML fragments on every 1 KiB block read. Attackers can provide malformed XML corpus files to cause severe CPU consumption and denial of service through affected...
CVE-2026-81722
nltk PorterStemmer in versions = 3.10.2 fixed in 3.10.3 contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem. The isconsonant helper walks backward over the entire run of trailing 'y' characters on every call, and measure invokes it for each stem position, causin...