28885 matches found
Out-of-bounds read vulnerability in Context2D.path and PathSvg.path properties impacts Qt Quick
...
Denial-of-service (stack-exhaustion) vulnerability in QXmlStreamReader::readElementText() impacts Qt
...
libsndfile 1.2.2 contains an integer overflow vulnerability in mat4_read_header() when parsing crafted MAT4 (MATLAB v4) files.
...
libsndfile 1.2.2 contains a misaligned memory access issue in psf_binheader_readf() while parsing WAV fmt chunks. A specially crafted WAV file can cause the function to cast an unaligned destination address to unsigned int * and perform a 4-byte store. This results in undefined behavior leading to denial of service.
...
libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a parameterized property, the function passes icalparameter_compare_kind_map() to bsearch() through an incompatible comparator function pointer type. bsearch() invokes the callback through the mismatched type, resulting in undefined behavior and process termination, leading to denial of service.
...
Busybox: busybox: dpkg read_package_field() steps past nul terminator, causing out-of-bounds read on malformed .deb packages
...
Microsoft Partner Center Elevation of Privilege Vulnerability
Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network...
Microsoft Bookings Elevation of Privilege Vulnerability
Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network...
Azure API Center Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Azure API Center allows an unauthorized attacker to disclose information over a network...
Azure Event Grid Spoofing Vulnerability
Missing authorization in Azure Event Grid allows an authorized attacker to perform spoofing over a network...
Microsoft Dataverse Remote Code Execution Vulnerability
Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network...
Azure App Service Remote Code Execution Vulnerability
Missing authentication for critical function in Azure App Service allows an unauthorized attacker to execute code over a network...
Azure SRE Agent Elevation of Privilege Vulnerability
Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network...
Apache Thrift: Lua `TJsonProtocol` string/number readers have no size bound and are quadratic
...
Apache Thrift: Lua `THttpTransport:_parseHeaders` matches each header line with a backtracking pattern (quadratic)
...
Apache Thrift: Erlang generated struct reads have no recursion-depth guard (unbounded memory)
...
Apache Thrift: PHP `thrift_protocol` accelerator dereferences a missing container-element spec
...
Apache Thrift: Java TSaslNonblockingServer pre-auth unbounded SASL frame allocation
...
Apache Thrift: c_glib generated struct readers have no recursion-depth guard (native stack exhaustion)
...
Apache Thrift: PHP `TSimpleServer` exits the whole process on any non-transport exception
...
Apache Thrift: Lua `TFramedTransport`/`THttpTransport` re-slice the buffer on every read (quadratic)
...
Apache Thrift: Java `TSaslNonblockingServer` `Computation.run` orphans a connection on a pre-auth parse error
...
net: lan743x: fix RX checksum use-after-free
...
Apache Thrift: c_glib multiplexed processor crashes on a message it cannot route
...
seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation
...
Apache Thrift: PHP `TJSONProtocol` string/number readers have no size bound
...
selinux: preserve user SID across nested backing files
...
Apache Thrift: javame `TJsonProtocol`/`TJSONProtocol` has no string size bound
...
net: bridge: mst: move switchdev call outside rcu
...
drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc
...
Apache Thrift: Dart `TBinaryProtocol.readMessageBegin` allocates from the pre-versioned name length
...
Apache Thrift: Buffered transport reads are not accounted against MaxMessageSize
...
ALSA: core: Fix potential UAF after asynchronous card release
...
Apache Thrift: An exception escaping a libevent callback stops the D library's non-blocking server, allowing an unauthenticated remote attacker to deny service
...
wifi: cfg80211: ibss: ref BSS entry for joined event
...
Apache Thrift: php `--gen php:inlined` struct readers (and `TProtocol::skipBinary`) have no recursion-depth guard
...
wifi: mac80211: only operate on TDLS peers in the TDLS code
...
Apache Thrift: PHP `thrift_protocol` C extension ignores the configured `maxStringSize`
...
dmaengine: Fix device kref underflow in dma_chan_put()
...
Apache Thrift: PHP framed/memory/HTTP transports re-slice the buffer on every read (quadratic)
...
wifi: mac80211: mesh: reset the CSA state when leaving
...
Apache Thrift: A truncated HTTP request stops the D library's server, allowing an unauthenticated remote attacker to deny service
...
mmc: mxcmmc: cancel data work and watchdog on remove
...
Apache Thrift: c_glib read_message_begin leaves output parameters unset for non-versioned messages
...
btrfs: handle lack of space when cleaning up verity items
...
Apache Thrift: Java `TSaslNonblockingServer`: residual of CVE-2026-61373 (thread-death black hole + no cross-connection budget)
...
mmc: sdio_uart: fix xmit_fifo leak when the port table is full
...
Apache Thrift, Apache Thrift: The C++ and D clients fall back to the certificate Common Name when subjectAltName entries are present but do not match
...