172869 matches found
CVE-2026-116579
Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. From 26.7.1 until 26.10.1, PerMessageBrotli.decompressmessagedata in compressbrotli.py calls the Brotli decompressor without an output limit and checks maxMessagePayloadSize only after a complete...
CVE-2026-116578
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start o...
CVE-2026-116577
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a head...
CVE-2026-116576
systeminformation is a System and OS information library for node.js. Prior to 5.33.16, services in lib/processes.js inserts a caller-supplied service name into a PowerShell Get-CimInstance filter after processing it with sanitizeShellString in lib/util.js. On Windows, the sanitizer removes ASCII...
CVE-2026-116502
A flaw has been found in turboderp-org ExLlamaV2 up to 0.3.2. The impacted element is the function QMatrix::makesequential of the file exllamav2/exllamav2ext/cuda/qmatrix.cu of the component GPTQ Index Handler. Executing a manipulation of the argument gidx can lead to out-of-bounds write. The...
CVE-2026-116575
Mem0 provides persistent memory infrastructure for AI agents and applications. Prior to Python SDK 2.0.18 and TypeScript SDK 3.1.6, buildsessionscope in mem0/memory/main.py and Memory.buildSessionScope in the TypeScript SDK join caller-controlled userid, agentid, and runid values using unescaped ...
CVE-2026-65630
Observable Timing Discrepancy vulnerability in potatosalad jose allows recovery of a long-term X25519 private key through a timing side channel in the pure-Erlang Curve25519 fallback. The pure-Erlang X25519 implementation performs scalar multiplication over the secret private key using a recursiv...
CVE-2026-65632
The jose library accepts ECDSA ES256, ES256K, ES384, and ES512 JWS signatures of a non-canonical length. When verifying an ECDSA signature, josejwkktyec:verify/4 in src/jwk/josejwkktyec.erl splits the raw signature in half by its actual byte length splitbinarySignature, bytesizeSignature div 2...
CVE-2026-65631
Inefficient Algorithmic Complexity in erlang-jose allows an unauthenticated remote attacker to cause a CPU-exhaustion denial of service by submitting a crafted RSA JSON Web Key. When an application parses an untrusted JWK through the public josejwk:frombinary/1 or josejwk:frommap/1 API or the...
CVE-2026-65629
Use of Password Hash With Insufficient Computational Effort in the jose library allows an attacker who obtains a password-encrypted private-key export to recover the private key through an offline password-cracking attack. When jose exports a password-encrypted private key with josejwk:toder/2...
CVE-2026-65628
josejwk:sharedsecret/2 exposed in Elixir as JOSE.JWK.sharedsecret/2 derives an ECDH shared secret from two JWKs. Its first function clause only matches when both JWKs carry the same key type kty module, and its fallback clause re-invokes itself as sharedsecretfromYourJWK, fromMyJWK. Because from/...
CVE-2026-65627
Improper Handling of Highly Compressed Data Data Amplification vulnerability in potatosalad jose erlang-jose allows a remote attacker to exhaust a node's memory with a small crafted JWE token. The josejwezip:uncompress/2 function in src/jwe/josejwezip.erl decompresses the DEFLATE-compressed...
CVE-2026-57184
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, insufficient bounds checking in the "chanooh323" "Q.931" "information-element parser" permits an "out-of-bounds read" that...
CVE-2026-65626
The pure-Erlang RSAES-PKCS1-v15 decryption in the josejwapkcs1 module is a Bleichenbacher padding oracle. emepkcs1decode/2 returns the recovered message when a decrypted block has valid PKCS1 v1.5 padding a leading 0x00 0x02, a padding string of at least eight non-zero bytes, and a 0x00 separator...
CVE-2026-65625
The pure-Erlang AES-GCM fallback in josejwaaes derives the number of verified authentication tag bits from the attacker-supplied tag itself. In the aesgcm, Bits clause of blockdecrypt/4, the incoming tag is guarded only by isbinary/1, with no check on its length. Verification in gcmblockdecrypt/6...
CVE-2026-57193
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the LDAP realtime driver "resconfigldap" may permit "LDAP filter injection" through a "SIP username", allowing an...
CVE-2026-116479
A flaw has been found in a2aproject a2a-java up to 1.2.0.Final. This impacts the function getMessage of the component JSON-RPC Error Handler. This manipulation causes information exposure through error message. The attack can be initiated remotely. Upgrading to version 1.3.0.Final will fix this...
CVE-2026-115533
The LeRobot library is vulnerable to arbitrary code execution via unsafe dynamic class instantiation in the frompretrained method and related paths. When loading a policy's processor configuration from a repository, the library uses the class field within the JSON configuration to dynamically...
CVE-2026-115927
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to...
CVE-2026-57187
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap-use-after-free in "PJSIP TCP/SDP" handling by sending a "SIP INVITE" over a...
CVE-2026-116478
A vulnerability was detected in a2aproject a2a-go up to 2.4.0. This affects the function CreateExecutor of the file a2asrv/agentexec.go of the component Push Notification Handler. The manipulation results in information exposure through error message. It is possible to launch the attack remotely...
CVE-2026-57196
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unauthenticated attacker may use reflected cross-site scripting in "phone provisioning HTTP error pages" to retrieve an...
CVE-2026-115924
Rembg is a tool to remove images background. Prior to 2.0.82, the public /api/remove endpoint passes attacker-controlled extras.sammodel through rembg/commands/scommand.py to rembg/sessions/sam.py, where it is interpolated into SAM filenames and GitHub download URLs passed to pooch.retrieve witho...
CVE-2026-116477
A security vulnerability has been detected in a2aproject a2a-dotnet up to 1.0.0-preview2. The impacted element is the function A2AJsonRpcProcessor.ProcessRequestAsync of the file src/A2A.AspNetCore/A2AJsonRpcProcessor.cs of the component Parser. The manipulation leads to information exposure...
CVE-2014-125135
A security vulnerability has been detected in OctoPrint 1.0.0/1.1.0. Affected is an unknown function of the component Flask Secret Key Handler. Such manipulation leads to use of hard-coded cryptographic key . The attack may be performed from remote. Upgrading to version 1.11.1 is able to address...
CVE-2026-116476
A weakness has been identified in a2aproject a2a-dotnet up to 1.0.0-preview3. The affected element is the function TaskProjection.ApplyStatus of the component TaskProjection. Executing a manipulation can lead to race condition. The attack may be performed from remote. The pull request to fix this...
CVE-2026-110720
Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtain elevated Consul privileges. This vulnerability CVE-2026-110720 is fixed in consul-k8s 2.1.0 and 1.8.18...
CVE-2026-116471
A security flaw has been discovered in BKWLD Decoy up to 5.11.1. The impacted element is an unknown function of the file Policy.php of the component Authorization Policy. The manipulation of the argument role results in improper privilege management. The attack may be performed from remote. The...
CVE-2026-116467
A security flaw has been discovered in ggml-org llama.cpp up to 0.7.0. Affected by this vulnerability is an unknown functionality of the file src/llama-sampler.cpp of the component Mirostat Sampler. The manipulation results in reachable assertion. It is possible to launch the attack remotely. The...
CVE-2026-115804
HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in health check registration that may allow an authenticated user to modify health checks belonging to another service on the same node. This vulnerability CVE-2026-115804 is fixed in Consul Community Edition 2.1.0 a...
CVE-2026-116634
OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to issue sync tokens via POST /api/sync/tokens when requireLogin is disabled. Attackers can use the issued token against GET /api/sync/bundle to retrieve decrypted provider...
CVE-2026-105626
HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that may allow an unauthenticated attacker to exhaust memory on a Consul agent. This vulnerability CVE-2026-105626 is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19...
CVE-2026-115923
Backstage is an open framework for building developer portals. Prior to 3.9.2 and from 4.0.0 until 4.0.2, DefaultCatalogRulesEnforcer in @backstage/plugin-catalog-backend compares the raw location.target URL against catalog.rules, while URL readers canonicalize the same URL before fetching it. An...
CVE-2026-105608
HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in service mesh proxy registration. This may allow a user with service write permission to apply Envoy escape-hatch configuration without the required mesh write permission. This vulnerability CVE-2026-105608 is fixe...
CVE-2026-105765
HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. This vulnerability...
CVE-2026-115922
Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. Prior to 1.22.0, unpack2bit and unpack4bit resize unpacked arrays according to attacker-controlled TensorProto.dims without verifying that rawdata or int32data encodes the declared number of elements...
CVE-2026-115921
Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.4.0 until 1.22.0, ScanInferenceFunction, ScanInferenceFunctionopset8, and ScanInferenceFunctionopset9 do not safely validate the required numscaninputs attribute. A missing attribute is dereference...
CVE-2026-115920
Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.2.1 until 1.22.0, ConvTranspose shape inference processes a weight tensor with fewer than three dimensions without a kernelshape attribute by deriving an empty effectivekernelshape and indexing it...
CVE-2026-115919
Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. Prior to 1.22.0, RNNShapeInferenceopset1to6 processes malformed RNN and LSTM nodes from opsets 1 through 6 and GRU nodes from opsets 3 through 6 without verifying that the first input has rank three. The...
CVE-2026-115918
vLLM is an inference and serving engine for large language models. From 0.16.0 until 0.32.0, the /v1/responses endpoint allows an authenticated caller to place an attacker-controlled template in chattemplatekwargschattemplate when no server template is configured...
CVE-2026-115917
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware with allowedorigins set to a wildcard by default. A malicious web page can use a victim's browser to reach an unauthenticated vLLM server on...
CVE-2026-81509
nforwardauth is a forward auth service that allows the use of a single authentication middleware for multiple sites. Versions prior to 1.5.1 accept an unvalidated "r" query parameter on the "/login" endpoint and use them as the post-authentication redirect destination. An unauthenticated attacker...
CVE-2026-115916
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes maxtokenid with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For a tensor-parallel size of one and an exact...
CVE-2026-115915
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageMediaIO passes attacker-controlled image bytes to Pillow through Image.openBytesIOdata without restricting decoder selection, and the MIME label does not constrain the selected format. Image-capable request...
CVE-2026-102649
Burrito is a Terraform Automation Collaboration Software TACoS Kubernetes operator. Prior to 0.13.0, "POST /api/webhook" accepts unsigned GitHub and GitLab events when a "TerraformRepository"'s credentials omit "webhookSecret" or set it to an empty value, including credentials configured for git...
CVE-2026-115914
vLLM is an inference and serving engine for large language models. From 0.11.1 until 0.32.0, the DeepSeek-OCR, DeepSeek-OCR-2, and Unlimited-OCR image path allows a remote client that can reach the OpenAI-compatible API to submit a legal image whose normalized pixels sum to zero when that image i...
CVE-2026-72758
When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the range, Routinator will never reach the maximum value and run out of memory...
CVE-2026-72757
Routinator runs out of open connections on the HTTP server when many connections are opened but never closed, leaving the HTTP server unavailable. This condition can be triggered maliciously by an attacker by opening a large number of connections to the HTTP server. This only affects users that...
CVE-2026-72756
Routinator exits when an rsync URI for a file obtained over RRDP contains a path that cannot be stored on disk, such as too long file names, and folder names that overlap with existing file names...