Tagged “cve.org”
CVEs tagged cve.org, newest first.
46495 CVEsRSS
CVE-2026-120452Medium· 5.4libgphoto2 through 2.5.34 Heap Out-of-Bounds Read/Write via jl2005c Thumbnail Conversion
libgphoto2 through 2.5.34 contains a heap out-of-bounds read and write vulnerability in jl2005bcd_decompress() that allows malicious USB cameras to corrupt heap memory via oversized thumbnail processing. Attackers can supply small alloca…
CVE-2026-120444High· 8.1PoCGoFound through 1.4.1 Path Traversal via database parameter in /api/db/drop
GoFound through 1.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary directories by supplying ../ sequences in the database parameter. Attackers can send GET requests to /api/db/create a…
CVE-2026-120460High· 8.8Jpom through 2.11.12 Cross-Workspace Authorization Bypass via Docker Controllers
Jpom through 2.11.12 contains a cross-workspace authorization bypass vulnerability that allows authenticated users to manage other workspaces' Docker hosts by supplying foreign Docker asset ids. Attackers with Docker permission in any wo…
CVE-2026-120456Medium· 6.1L-SMASH through 2.14.5 Heap Out-of-Bounds Write via hdlr and url Boxes
L-SMASH through 2.14.5 contains a heap out-of-bounds write vulnerability in isom_read_hdlr() and isom_read_dref_entry() in core/read.c triggered by oversized box sizes. Attackers can supply crafted MP4 or MOV files declaring hdlr or url …
CVE-2026-120448High· 8.1PoCDoraCMS through 3.1.0 Mass Assignment via API Key Update Endpoint
DoraCMS through 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint that allows authenticated low-privileged users to rebind their API key to another user's account. Attackers can set the userId f…
CVE-2026-120489Medium· 4.3Outline before 1.12.0 Incorrect Authorization via authorizeDocumentPublish() Detached Draft
Outline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish() that allows authenticated members to publish documents into private collections without write access. Attackers can detach a child docu…
CVE-2026-117067NoneAn out-of-bounds memory access vulnerability in the N2 SCTP interface of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service (DoS) by repeatedly establishing SCTP associations, re…
An out-of-bounds memory access vulnerability in the N2 SCTP interface of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service (DoS) by repeatedly establishing SCTP associations, re…
CVE-2026-117068High· 7.5PoCAn integer underflow vulnerability in the NAS decoder of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service (DoS) via crafted NAS Registration Requests containing a truncated SUC…
An integer underflow vulnerability in the NAS decoder of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service (DoS) via crafted NAS Registration Requests containing a truncated SUC…
CVE-2026-120596High· 7.5CVE-2026-120596
A remotely exploitable denial-of-service vulnerability exists in the TCP options parser of the Nut/Net TCP/IP stack included in Nut/OS, developed by Ethernut/Egnite. Nut/OS releases up to version 5.1 are affected. An unauthenticated atta…
CVE-2026-119301High· 7.9Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandas
Improper neutralization of quoting syntax in SQL identifier construction in the Apache Iceberg write component in AWS SDK for pandas (also published as awswrangler) 3.5.2 through 3.17.0 might allow an authenticated remote user with permi…
CVE-2026-20566Medium· 4.8In Modem, there is a possible out of bounds write due to a missing bounds check
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, if a malicious actor has already obta…
CVE-2026-20550Medium· 6.2In gnss, there is a possible out of bounds write due to a missing bounds check
In gnss, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS1130981…
CVE-2026-18800Medium· 4.4Information Disclosure via Event Publisher Logging in Multiple WSO2 Products Allows Retrieval of Sensitive Data
When an Event Publisher output adapter is configured with properties that are irrelevant to its function, the affected products log these irrelevant properties. This can inadvertently include sensitive user credentials or other confident…
CVE-2026-120214Medium· 5.9@fastify/http-proxy vulnerable to prefix escape via percent-encoded backslash dot-segments
@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 11.6.0 through 11.6.2, the destination validation normalizes literal backslashes before it percent-decodes th…
CVE-2026-120213Critical· 9.1@fastify/http-proxy vulnerable to prefix escape via decoded route parameters
@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients …
CVE-2026-2613High· 8.7SQL Injection via Admin REST API in Multiple WSO2 Products Allows Database Information Inference and Service Disruption
The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements. A user with administrator privileges can exploit this by influencing the structure of execut…
CVE-2026-20552Medium· 6.5In ccci, there is a possible out of bounds write due to a missing bounds check
In ccci, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS115234…
CVE-2026-20553Medium· 6.8In DA, there is a possible out of bounds write due to a missing bounds check
In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User intera…
CVE-2026-20551Medium· 5.5In gnss, there is a possible out of bounds write due to a missing bounds check
In gnss, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS1130930…
CVE-2026-120215Low· 3.7@fastify/cors vulnerable to Denial of Service on a CORS preflight with the onSend hook
@fastify/cors is the CORS plugin for the Fastify web framework. In versions 8.2.0 through 11.3.x, an application that registers the plugin with the non-default onSend hook option crashes on a CORS preflight. On an OPTIONS request that ca…
CVE-2025-12544Medium· 4.8Stored Cross-Site Scripting in Multiple WSO2 Products
The Publisher portal fails to enforce proper validation on uploaded SVG files, allowing users with the Publisher role to inject malicious scripts. This weakness can be exploited by uploading a crafted SVG file, which is then stored and r…
CVE-2026-117549Medium· 4.2@fastify/secure-session vulnerable to signature verification bypass via cookie signature removal
@fastify/secure-session is a session plugin for Fastify that stores an encrypted session in a cookie. In versions 7.5.0 through 8.4.1, when the plugin is configured with the signed cookie option, it calls the cookie unsign routine but, w…
CVE-2024-2372Medium· 5.4Open Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing Attacks
The affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that can redirect users to an arbitrary external dom…
CVE-2026-117531Medium· 5.9@fastify/multipart vulnerable to Denial of Service via a malformed upload hanging delayed file consumers
@fastify/multipart is the multipart form-data and file upload plugin for the Fastify web framework. In versions 5.3.0 through 10.1.6, the plugin does not propagate a parser error to the file stream when a request body ends inside a file …
CVE-2026-117518High· 8.2@fastify/reply-from vulnerable to path traversal via backslash dot-segment prefix escape
@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP server. In versions up to and including 12.8.0, the plugin validated proxy paths against forward-slash dot-segments only and then built the target with th…
CVE-2026-120216Medium· 5.9fastify vulnerable to Denial of Service via uncaught exception on handlerTimeout with streaming responses
fastify is a web framework for Node.js. In versions 5.8.0 through 5.12.7, when the server is configured with a nonzero handlerTimeout and a route returns a streaming response, a request whose stream has already sent its headers but stays…
CVE-2026-100140Low· 1.9Integer overflow vulnerability in XML parsing functionality of Qt5Compat impacts Qt
An integer overflow vulnerability in the Qt XML parsing (Qt5Compat / QXmlSimpleReader) functionality of Qt.
CVE-2024-9517Medium· 4.9Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked Accounts
The refresh token grant type in WSO2 products fails to re-validate account status before issuing new access tokens. This weakness allows an attacker to obtain valid access tokens for user accounts even after they have been blocked by the…
CVE-2026-92886High· 7.8Local Privilege Escalation via Polkit Misconfiguration in TÜBİTAK BİLGEM's eta-register
Missing Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-register allows Privilege Escalation. This issue affects eta-register: from 2.0.8 before 2.0.9.
CVE-2024-12141Medium· 4.3Open Redirect via Callback URL Validation in WSO2 Products Allows Phishing Attacks
The product fails to sufficiently validate callback URLs, allowing them to be manipulated with malicious payloads when processed through a weak regular expression or when validation is omitted. An attacker can exploit this by crafting a…