85296 matches found
CVE-2026-105274
Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hexcore allows an untrusted repository mirror, or a server answering hexcore's API requests, to exhaust the memory of the Erlang VM running hexcore. The same code is vendored in Hex mixhexrepo, mixhexapi and...
CVE-2026-109256
FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR pngwritedata callback that writes past the buffer after a realloc failure. A malicious RDP clipboard peer can supply a large CFDIB image that triggers out-of-bounds memcpy during PNG conversion, causing a client crash...
CVE-2026-109272
ImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer dereference in the PostScript decoder that is triggered when a policy limit is reached. Attackers can supply a crafted PostScript file for processing to crash the application, causing a denial of service...
CVE-2026-109273
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the PostScript decoder, which allocates a buffer one byte longer than the data it decoded. Attackers can supply a crafted PostScript file to expose a single uninitialized byte of memory conten...
CVE-2026-109348
Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust CPU through quadratic-time parsing in Snapshot::frombytes. Attackers can commit a crafted .mailmap with descending-ordered entries forcing repeated front inserts, blocking workers runnin...
CVE-2026-109243
FreeRDP from 3.0.0 before 3.32.0 contains an incorrect permission assignment vulnerability that allows local users to read private keys written by cryptowritepem without owner-only permissions. Attackers on multi-user Unix hosts can enumerate the shared temporary directory during soft-smartcard...
CVE-2026-96612
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's deps directory and extract package files into it when a developer fetches dependencies. A package release's...
CVE-2026-81856
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicious package publisher or a hostile repository server to inject terminal control sequences into the output of Mix tasks. Hex prints strings supplied by the package repository and the documentati...
CVE-2026-109399
SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdatecmsverifyopenssl.c that trusts untrusted X.509 certificates embedded in CMS SignedData for chain building. Attackers holding a signing key from a sibling intermediate under the same root can emb...
CVE-2026-103060
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's build directory and extract package files into it when a developer fetches dependencies. A package release's...
CVE-2026-105668
Protection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who has taken over the owner's account, to get a newly published release past the release-age cooldown. The cooldown cooldown config, HEXCOOLDOWN withholds versions younger than the configured ag...
CVE-2026-105280
Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarball that mix hex.package fetch PACKAGE VERSION --output - writes to standard output. Hex compares a fetched tarball's inner and outer checksums with the repository's signed regist...
CVE-2026-103503
Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and holds a certificate for a Hex host issued by a CA in Hex's bundled CA store, to impersonate that host to users who set cacertspath to a CA store that leaves that CA out...
CVE-2026-92877
The JAXB factory methods historically relied solely on FEATURESECUREPROCESSING to prevent XML External Entity XXE resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker who can get untrusted XML unmarshalled through JAXB can read local...
CVE-2026-108094
A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicious Wayland client can destroy a wpimagedescriptionv1 resource while an asynchronous ICC file read is still in progress. When the read completes, the composit...
CVE-2026-103502
Improper Certificate Validation vulnerability in hexpm hexcore allows an attacker who can intercept HTTPS connections to impersonate hex.pm, repo.hex.pm or any other repository or API server to programs that use hexcore's default HTTP adapter on Erlang/OTP 24, or on OTP 25 when the operating...
CVE-2026-108834
A vulnerability was detected in Cairo-dock Glx-Dock up to 3.4.0. This issue affects some unknown processing of the file wwpage.php of the component Query Parameter Handler. Performing a manipulation of the argument p results in cross site scripting. The attack is possible to be carried out...
CVE-2026-105081
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowing configured policy restrictions to be bypassed. Local attackers who can create a symlink can point it at a policy-restricted path to eva...
CVE-2026-108831
A security vulnerability has been detected in meetecho janus-gateway up to 1.4.2. This vulnerability affects unknown code of the file html/demos/admin.js of the component Admin API. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit has been...
CVE-2026-108830
A weakness has been identified in meetecho janus-gateway up to 1.4.2. This affects an unknown part of the file src/plugins/janusvideoroom.c of the component VideoRoom. This manipulation causes race condition. Remote exploitation of the attack is possible. The attack's complexity is rated as high...
CVE-2026-103902
Improper verification of cryptographic signature vulnerability in DigiDoc libdigidocpp, DigiDoc DigiDoc4, DigiDoc DigiDoc Android, and DigiDoc DigiDoc iOS. The vulnerability allows an attacker to create forged digital signatures that are displayed a valid by affected DigiDoc software.This issue...
CVE-2026-108822
A vulnerability was detected in Kamailio up to 6.0.7/6.1.3. The affected element is the function isupgetcallingparty of the file src/modules/sipt/ss7parser.c of the component sipt Module. The manipulation of the argument length results in buffer overflow. The attack may be performed from remote...
CVE-2026-48212
An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page. This issue affects OTRS: 7.0.X 8.0.X 2023.X 2024.X 2025.X 2026.X before 2026.7.X...
CVE-2026-48211
An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery CSRF attack. The OTRS AdminImportExport::TemplateDelete action does not validate the request's ChallengeToken, allowing an unauthenticated remote attacker to craft a...
CVE-2026-78358
Several administrative actions do not sufficiently validate whether a request was intentionally initiated by the authenticated user. In particular, the DBUpdateLogCleanUp action can be triggered through a GET request without validating a ChallengeToken. An unauthenticated remote attacker can...
CVE-2026-78357
Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. As a result, an existing JWT may remain valid until its regular expiration time, which can be approximately 16 hours. An attacker who has...
CVE-2026-78356
The OTRS Agent Frontend configuration endpoint can be accessed without authentication. This allows unauthenticated remote users to retrieve internal application configuration that is intended for use by the authenticated Agent Frontend. The exposed information may include configured frontend rout...
CVE-2026-78355
A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended directory. This may allow files accessible to the OTRS application process to be deleted. The vulnerability does not bypass operating syste...
CVE-2026-93581
User-controlled values are not sufficiently neutralized when included in CSV exports. Values originating from user input, including data submitted by authenticated users or received through external communication channels such as email, may be stored in fields that are later included in CSV...
CVE-2026-93582
The HTTP Basic Authentication modules in OTRS Community Edition 6 and prior accept the authenticated username from either the REMOTEUSER or HTTPREMOTEUSER environment variable. In CGI and modperl based deployments, HTTP request headers may be mapped to corresponding HTTP environment variables. As...
CVE-2026-78359
OTRS does not sufficiently enforce the uniqueness of customer user identities across multiple configured CustomerUser backends. When multiple backends, such as a database and LDAP, are configured, the uniqueness check for customer user email addresses is performed only within the selected backend...
CVE-2026-98385
In the Linux kernel, the following vulnerability has been resolved: sched/cache: Decouple schedcachegroup from mm to fix UAF Currently the sched cache grouping is by mm and the scheduling statistics schedcachestat lives in the mm structure. This ties the life cycle of scheduling stats with mm. In...
CVE-2026-108985
ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs-zdr.c with libnfszdrbytes, libnfszdrstring, and libnfszdrarray. The caller-supplied maxsize value is not honored...
CVE-2026-108981
ngxcachepurge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application e.g., WordPress run under the same user account. The attacker must be able to create a symlink inside the cache path. Version 3.0.4 fixes this for the case of a symli...
CVE-2026-108978
Heap-based buffer overflow vulnerability in Samsung Opensource rlottie allows Buffer Overflow via Environment Variables. This issue affects rlottie: e57b094f03c39a751a1fded6f7d6c13f1ed95ec9...
CVE-2026-108976
GNU Emacs before 31.2 and TRAMP through 2.8.2 allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992...
CVE-2026-108752
JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username. Attackers holding a name like alice-prod can overwrite the client for alice's server prod, breaking...
CVE-2026-108735
Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by setting a feed's proxyurl. Attackers can point proxyurl at loopback or internal hosts, bypassing FETCHERALLOWPRIVATENETWORKS checks to probe internal...
CVE-2026-108726
GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authenticated low-privileged users to search itemtypes they cannot view by omitting the canView check. Attackers can submit crafted itemtype and search criteria for types like Contact, Supplier, Contrac...
CVE-2026-108577
A vulnerability was determined in Konstanty Bialkowski libmodplug up to 0.8.9.1. This issue affects the function abcaddgchord of the file src/loadabc.cpp of the component ABC Music Format Parser. This manipulation causes resource consumption. The attack may be initiated remotely. The vendor was...
CVE-2026-108573
A vulnerability was detected in Open Asset Import Library Assimp up to 6.0.5. Affected by this vulnerability is the function IOStreamBuffer::getNextBlock of the component PLY File Handler. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. The...
CVE-2026-108539
A vulnerability was detected in GPAC up to 26.07.0. This affects the function gffqpop of the file filtercore/filterqueue.c of the component MP4Box. Performing a manipulation results in use after free. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was...
CVE-2026-108538
A security vulnerability has been detected in GPAC up to 26.07.0. The impacted element is the function gfmxv of the file utils/osthread.c of the component MP4Box. Such manipulation leads to use after free. The attack can be launched remotely. The exploit has been disclosed publicly and may be use...
CVE-2026-108546
Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are...
CVE-2026-108553
OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating...
CVE-2013-10076
ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps call avextend av, len-1 . On an empty list, this undeflows, and avextend will allocate an array with 2^32 slots, leading to memory exhaustion...
CVE-2026-107373
ExtUtils::Typemaps::STL::String versions before 1.06 for Perl TSTDSTRING typemap may read the SV length before stringifying the argument. The typemap uses $var = std::string SvPVnolen$arg, SvCUR$arg However, evaluation order for C++ arguments is not specified, and some compilers may produce code...
CVE-2026-107794
ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps call avextend av, len-1 . On an empty list, this undeflows, and avextend will allocate an array with 2^32 slots, leading to memory exhaustion. Note that a similar issue was...
CVE-2026-92705
Aegisub is a cross-platform advanced subtitle editor. From 3.2.0 to 3.4.2, Aegisub automatically loads Automation scripts referenced by Automation Scripts metadata in ASS subtitle projects without asking whether the user trusts the scripts or their authors. An attacker can distribute a crafted AS...