Baza CVE

Przepełnienie bufora w PyOpenEXR umożliwia zdalne wykonanie kodu.

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, exrmultiview can write past a heap allocation when it combines two attacker-supplied,…

Luka w przejściu ścieżki w kliencie SonicWall NetExtender umożliwia zapis dowolnego pliku jako root.

Nieprawidłowe zarządzanie plikami tymczasowymi w SonicWall NetExtender umożliwia manipulację ścieżkami plików.

Przepełnienie bufora w OpenEXR umożliwia odczyt pamięci poza przydzielonym obszarem.

icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 7.1.0 until 7.1.3, the Component equality method in src/icalendar/cal/component.py compares nested subcomponents with two membership loops, and each membership test invokes the same method on child…

A Content Security Policy bypass was addressed with improved enforcement in AudioWorklet contexts. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5. Processing maliciously crafted web content may bypass Content Security Policy.

Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For sse and streamable-http…

In Dradis Community Edition, the ProvidersController and AgentsController gate their admin_required before_action on `defined?(Dradis::Pro)`, a constant that is never defined in CE, so the authorization check is never applied. As a result, any authenticated (non-admin) user can create an AI…

Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. AuthorizationServerHandler copies recognised identifiers out of the raw JSON request body into X-Airbyte-* headers, and AuthenticationHeaderResolver.resolveWorkspace consults…

ContiNew Admin fails to apply file-upload permission checks or file-type allowlist validation to multipart upload endpoints, allowing authenticated users to store files with arbitrary extensions. Attackers can initialize chunked uploads, send file parts, and complete uploads to leave arbitrary…

Brak walidacji URI przekierowania w Coroot MCP umożliwia przejęcie sesji użytkowników.

sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant systems in sublinear time. Prior to consciousness-explorer 1.1.2 and sublinear-time-solver 1.6.0, the export_state and import_state tools in src/consciousness-explorer/mcp/server.js pass the…

eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, eml_parser.routing.noparenthesis in eml_parser/routing.py removes parenthesized CFWS comments from Received: headers with a regex-based…

Błąd w Emacs TRAMP umożliwia lokalnemu atakującemu wykonanie dowolnego kodu.

Luka w Substance3D Painter umożliwia zdalne wykonanie kodu po otwarciu złośliwego pliku.

Przepełnienie bufora w Substance3D Painter umożliwia zdalne wykonanie kodu po otwarciu złośliwego pliku.

Wykonywanie kodu w Substance3D Painter może być możliwe przez zdalne wprowadzenie złośliwego pliku.

Wykorzystanie podatności w Substance3D Painter umożliwia zdalne wykonanie kodu po otwarciu złośliwego pliku.

Przepełnienie bufora w Substance3D Painter umożliwia zdalne wykonanie kodu po otwarciu złośliwego pliku.

Przepełnienie bufora w Substance3D Painter umożliwia zdalne wykonanie kodu po otwarciu złośliwego pliku.

Przepełnienie bufora w Substance3D Painter umożliwia zdalne wykonanie kodu po otwarciu złośliwego pliku.

CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not…

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user…

Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.