| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-124318 | 7.2 | Treeio through 2.0 contains an insecure deserialization vulnerability in UpdateRecord.get_format_strings and ModuleSetting.loads that allows staff users to execute code via unverified pickle data. Attackers can store a crafted base64 pickle payload i | 2026-11-07 15:17:16 | 2026-11-07 15:17:16 |
| CVE-2026-124317 | 4.8 | libexpat through 2.10.0 contains an out-of-bounds read vulnerability in unknown_toUtf8() and unknown_toUtf16() in xmltok.c when handling application-registered unknown encodings. Attackers can supply a document ending in a truncated multibyte sequenc | 2026-11-07 15:17:16 | 2026-11-07 15:17:16 |
| CVE-2026-124316 | 4.3 | Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted erpnext.buying.utils.get_linked_material_requests method lacking document or company permission checks. Authenticated users, incl | 2026-11-07 15:17:16 | 2026-11-07 15:17:15 |
| CVE-2026-124315 | 6.5 | Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted get_bom_items and get_bom_diff methods that skip BOM read permission checks. Any authenticated user, including portal or no-role | 2026-11-07 15:17:15 | 2026-11-07 15:17:15 |
| CVE-2026-124314 | 6.5 | Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in erpnext.crm.utils.get_open_activities that exposes ToDo and Event records. Any authenticated user, including portal or no-role users, can supply | 2026-11-07 15:17:15 | 2026-11-07 15:17:15 |
| CVE-2026-124313 | 4.3 | Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted get_linked_payments_for_doc method. Any authenticated user, including portal users, can supply arbitrary company, doctype, and do | 2026-11-07 15:17:15 | 2026-11-07 15:17:15 |
| CVE-2026-124312 | 4.7 | Fraunhofer HHI VVdeC through 3.2.1 contains a heap out-of-bounds read vulnerability that allows attackers to crash the decoder by supplying a collocated picture of different resolution. Attackers can craft a VVC bitstream enabling TMVP with a smaller | 2026-11-07 15:17:15 | 2026-11-07 15:17:15 |
| CVE-2026-124311 | 5.5 | Fraunhofer HHI VVdeC through 3.2.1 contains a NULL pointer dereference vulnerability in InterPrediction::xPredInterBlk that allows attackers to crash the decoder by switching SPS to enable reference wrap-around. Attackers can supply a crafted VVC bit | 2026-11-07 15:17:14 | 2026-11-07 15:17:14 |
| CVE-2026-124310 | 6.1 | Fraunhofer HHI VVdeC before 3.2.1 contains an out-of-bounds read vulnerability that allows attackers to crash the decoder by supplying bitstreams with overlapping slice CTU coverage. Attackers can code a CTU in a second slice so a bi-predicted BDOF c | 2026-11-07 15:17:14 | 2026-11-07 15:17:14 |
| CVE-2026-124309 | 6.1 | Fraunhofer HHI VVdeC before 3.2.1 contains a heap out-of-bounds read vulnerability in SEIReader::xParseSEIScalableNesting that allows attackers to read past heap allocations by casting the SEI wrapper object instead of its payload. Attackers can supp | 2026-11-07 15:17:14 | 2026-11-07 15:17:14 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/39953
Zapisa po stranici: