402315 matches found
CVE-2026-91102
The HP Linux Imaging and Printing (HPLIP) software is affected by multiple vulnerabilities, including CVE-2026-91102 , which involves a Download Without Integrity Check (CWE-78 / CWE-494). Specifically, the HPLIP Printer Application (PAPPL-based web interface) allows attackers to download and exe...
CVE-2026-73442
CVE-2026-73442 affects Arista EOS switches with VRRP configured (any version; authentication not required). The root cause is CWE-532 : peer device VRRP authentication credentials are written in cleartext to agent trace logs on the switch. An authenticated user with sufficient privileges (or a sy...
CVE-2026-91101
The HP Linux Imaging and Printing (HPLIP) software contains multiple vulnerabilities in several components. These flaws could allow a remote attacker to achieve remote code execution , privilege escalation , denial of service , information disclosure , or unauthorized file modification under cert...
CVE-2026-81876
HAPI FHIR (a Java implementation of the HL7 FHIR healthcare standard) is vulnerable to a denial of service in versions prior to 6.9.12 . The flaw is in SHCParser , where processing a Smart Health Card JWT with a zip: "DEF" header and an empty or truncated raw-DEFLATE payload causes Inflater.infla...
CVE-2026-91100
The HP Linux Imaging and Printing (HPLIP) software contains multiple vulnerabilities across several components. These flaws could potentially allow a remote attacker to achieve remote code execution , privilege escalation , denial of service , information disclosure , or unauthorized file modific...
CVE-2026-73443
Arista EOS is vulnerable to a VRRPv2 IP-AH authentication capture-replay attack (CWE-294). An unauthenticated attacker on the same layer 2 segment can replay a legitimate authenticated VRRP advertisement to advertise stale state, preventing a backup router from assuming the virtual gateway role a...
CVE-2026-91099
Several vulnerabilities exist within the HP Linux Imaging and Printing (HPLIP) software across multiple components. These flaws could potentially allow a local attacker to achieve local code execution , escalate privileges, cause a denial of service (DoS) , disclose sensitive information, or perf...
CVE-2026-92472
A use-after-free vulnerability in GPAC 26.08-DEV , specifically in the function gf_node_deactivate_ex within src/scenegraph/base_scenegraph.c of the MP4Box component, can be triggered locally to impact availability (low impact, no confidentiality or integrity loss). A proof-of-concept exploit has...
CVE-2026-81875
HAPI FHIR (a Java HL7 FHIR interoperability library) is vulnerable to a denial-of-service via its SHCParser component. When processing attacker-controlled Smart Health Card JWTs containing a zip: "DEF" header with a small raw-DEFLATE payload, the inflate() and decompress() methods accumulate deco...
CVE-2026-91098
HP has identified and remediated multiple vulnerabilities within the HPLIP (HP Linux Imaging and Printing) software. These flaws affect several components and could potentially allow a remote attacker to achieve remote code execution , privilege escalation , denial of service , information disclo...
CVE-2026-77360
oRPC is a tool for building type-safe APIs adhering to OpenAPI standards. Prior to 1.14.8 , the @orpc/server CORS plugin (packages/server/src/plugins/cors.ts) copies a client's incoming Vary request header into the response instead of controlling Vary as a response-only header and using Origin fo...
CVE-2026-68536
CVE-2026-68536 affects Apache MyFace Core , a Java-based facelets rendering engine, where a Server-Side Request Forgery (SSRF) / Local File Inclusion flaw allows an attacker to induce the server to make requests to arbitrary URLs or read local files. Older unsupported versions may also be affecte...
CVE-2026-86003
CoreDNS (a DNS server written in Go) prior to 1.14.7 fails to enforce the dns.DefaultMsgAcceptFunc request policy on its DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC listeners. Unlike the UDP, TCP, and DNS-over-TLS paths, these listeners call dns.Msg.Unpack without that polic...
CVE-2026-91097
The HPLIP Printer Application (a PAPPL-based web interface) is vulnerable to a Path Traversal in plugin.spec and a default unauthenticated state in versions prior to 3.26.6 . These flaws allow a remote attacker to perform an unauthenticated administrative takeover chain, including configuration t...
CVE-2026-82399
CoreDNS versions prior to 1.14.7 are vulnerable to unauthenticated memory exhaustion via the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC request paths. The root cause is that dns.Msg.Unpack is called on attacker-controlled DNS section counts before dns.DefaultMsgAcceptFunc v...
CVE-2026-59823
LiteLLM is a proxy server (AI Gateway) for calling LLM APIs. Prior to version 1.83.9 , an authenticated caller holding a valid virtual key could place api_base inside the user_config request body, bypassing the is_request_body_safe check that blocks top-level api_base and base_url but did not ins...
CVE-2026-81176
Svelte devalue is a JavaScript library used for serializing values beyond what JSON.stringify supports. Prior to 5.9.2 , the devalue.parse function in src/parse.js failed to reject out-of-bounds indices greater than or equal to values.length. A specially crafted untrusted payload can cause the pa...
CVE-2026-92729
SigNoz versions 0.88.0 through 0.141.0 fail to apply authorization wrappers to trace-funnel analytics endpoints in the HTTP handler. Unauthenticated attackers over the network can submit arbitrary funnel definitions to retrieve trace analytics — including identifiers, durations, span counts, serv...
CVE-2026-75516
The RabbitMQ Java client (versions prior to 5.34.0 ) contains a logic flaw where AMQConnection.start() computes Math.min(maxInboundMessageBodySize, frameMax) after Connection.Tune negotiation. Since both the client default and AMQP's zero-value frameMax resolve to zero, Utils.framePayloadLimit(in...