Tagged “cve.org”
CVEs tagged cve.org, newest first.
47129 CVEsRSS
CVE-2026-118567Medium· 4.7Bulk Update User Roles - Moderately critical - Incorrect authorization - SA-CONTRIB-2026-280
Incorrect Authorization vulnerability in Drupal Bulk Update User Roles allows Forceful Browsing. This issue affects Bulk Update User Roles versions: from 0.0.0 to 1.0.5.
CVE-2026-118584Medium· 5.3Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-289
Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.
CVE-2026-118554Medium· 5.4OpenID Connect Client - Moderately critical - Improper authentication - SA-CONTRIB-2026-287
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1.
CVE-2026-118583Medium· 5.3Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-288
Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.
CVE-2026-118568Low· 3.3Content Sync (content-sync.io) - Moderately critical - Information disclosure - SA-CONTRIB-2026-291
Insecure Storage of Sensitive Information vulnerability in Drupal Content Sync (content-sync.io) allows Retrieve Embedded Sensitive Data. This issue affects Content Sync (content-sync.io) versions: from 0.0.0 to 3.2.2.
CVE-2026-118571Medium· 5.9Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-292
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Media Alias Display versions: from 0.0.0 to…
CVE-2026-74915High· 8.8GPU DDK - OOB write in UntwiddlePOTSquare64bpp
A web page that contains unusual WebGPU content loaded into the GPU GLES render process can trigger a OOB read and/or write crash in the GPU GLES user-space shared library. On certain platforms, when the process executing graphics worklo…
CVE-2026-74912Critical· 9.8GPU DDK - Fix for CVE-2026-49746 prevents the mapping of graphics buffers > 4GB
On GPU systems with the security vulnerability fix for CVE-2026-49746 applied, the mapping range of graphics buffers is limited which causes errors when the mapping outside of that range. Integer truncation caused when mapping GPU buffe…
CVE-2026-18629High· 7.5GPU DDK - libusc.so NPD due to integer overflow at ConvertSwitchToArrayLookup during WebGPU shader compilation
A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can lead memory allocation failure. If the allocation failure is not properly handled, the compiler may dereference a NULL pointer at a controll…
CVE-2026-15466High· 7.0GPU DDK - Write UAF due to a race condition caused by insufficient locking in PVRSRVRGXCloseHWPerfClientStreamKM()
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause race condition in hardware performance counters buffer’s destruction path leading to read and/or write UAF. The race condition in the d…
CVE-2026-19199High· 7.1GPU DDK - OOB write due to freelist size integer overflow in RGXCreateHWRTDataSet
Software installed and run as a non-privileged user may conduct improper system calls to allocate physical memory. A 32-bit integer overflow in the KM driver during page-to-byte conversion of an allocation size can result in an undersize…
CVE-2026-65587Medium· 5.5GPU DDK - OOB write in CalculateNPOTTwiddleSparsePageMap via TEXTURE_BASE_LEVEL change
A web page that contains unusual WebGPU content loaded into the GPU GLES render process can trigger an OOB write in the GPU user-space driver, leading to memory corruption and possible browser/GPU process crash. The software writes da…
CVE-2026-65586High· 7.1GPU DDK - Write UAF due to missing cleanup reference for abort command submitted via PVRSRVRGXKickTA3DKM
Software installed and run as a non-privileged user may conduct improper GPU system calls to free memory in still in use, replace with another allocation and cause arbitrary memory reads or writes to physical memory pages. A memory bu…
CVE-2026-65584High· 7.8GPU DDK - Stack Buffer Overflow via undersized UFO address array in DumpStalledContextInfo
Software installed and run as a non-privileged user may conduct improper GPU system calls causing a stack overflow in the kernel. The overflow occurs when processing resolved Linux/Android fence synchronization checkpoints, while user ch…
CVE-2026-112605Low· 3.3This issue was addressed with improved handling of symlinks
This issue was addressed with improved handling of symlinks. This issue is fixed in Xcode 27.2. An app may be able to read arbitrary files.
CVE-2026-112602Low· 3.3An authorization issue was addressed with improved state management
An authorization issue was addressed with improved state management. This issue is fixed in Xcode 27.2. An app may be able to access sensitive user data.
CVE-2026-118959Medium· 5.4Keycloak-services: keycloak-services: required actions bypassed via kc_action parameter
A flaw was found in the required action provider mechanism of Keycloak. The issue occurs when an authorization request includes the kc_action query parameter set to a mandatory action already assigned to the user, such as profile verific…
CVE-2026-118947Medium· 4.3Keycloak-services: keycloak-services: authorization bypass via uma resource registration idor
A flaw was found in the UMA resource registration endpoint of the keycloak-services component, which provides the core logic for Keycloak's authorization and identity services. The issue occurs when remote resource management is enabled,…
CVE-2026-119285Medium· 5.9PoCFiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads
Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads
CVE-2026-59978High· 7.5PoCAdminNeo: version-cache array injection causes persistent denial of service
AdminNeo is a full-featured database management tool written in PHP. From 4.6.2 until 5.5.0, the unauthenticated `?script=version` endpoint accepts POST data without origin, CSRF or parameter-type validation. A `version[]` parameter beco…
CVE-2026-63414High· 7.6Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps
Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, `token-exchange` authenticated controllers can expose a request-derived `shop` context instead of the identity from a verified Shopify ID token or…
CVE-2026-62264High· 7.5PDF Reader MCP: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY
PDF Reader MCP is a Model Context Protocol server for reading PDF documents. In versions 2.2.0 and later prior to 3.0.1, when `MCP_TRANSPORT=http` enables the opt-in HTTP server, `@sylphx/pdf-reader-mcp` reads `MCP_API_KEY` and logs that…
CVE-2026-61847Medium· 6.3Crass: A large number of adjacent CSS comments can trigger a SystemStackError
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when the `:preserve_comments` option is not enabled, which is the default, Crass discards CSS comments by recursively consuming …
CVE-2026-61846Medium· 6.3Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass recursively parses `CSS simple blocks and functions` without a depth guard. An attacker-controlled CSS value containing de…
CVE-2026-61848Medium· 6.3Crass: Non-ASCII characters cause superlinear CPU consumption
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing `non-ASCII characters`, inefficiencies in tracking the positions of `multi-byte characters` r…
CVE-2026-116773Medium· 4.3russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets
russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets
CVE-2026-116774Medium· 4.3russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)
russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)
CVE-2026-116689High· 5.9follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects
follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects
CVE-2026-116672High· 8.8Authlib RFC 7592 examples omit registration-access-token client binding
Authlib RFC 7592 examples omit registration-access-token client binding
CVE-2026-61845High· 8.9Crass: Large numeric exponents cause CPU and memory denial of service
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass converts `CSS scientific notation` number values with unbounded exponentiation before clamping the result to `Float::MAX`.…