| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-128343 | 7.5 | exceljs through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying unbounded row r attributes parsed in row-xform.js. Attackers can craft an XLSX file with a row numbered far beyond Excel's lim | 2026-11-13 23:17:18 | 2026-11-13 10:18:14 |
| CVE-2026-128339 | 7.5 | ExcelJS through 4.4.0 contains a memory exhaustion vulnerability in Worksheet._parseMergeCells that allows attackers to crash applications by supplying unbounded mergeCell ranges. Attackers can craft a small workbook with a mergeCell ref like A1:XFD1 | 2026-11-13 23:17:18 | 2026-11-13 10:18:14 |
| CVE-2026-128242 | 7.5 | actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, defla | 2026-11-13 23:17:18 | 2026-11-13 10:18:12 |
| CVE-2026-128239 | 5.5 | GPAC through 26.07.0 contains a NULL pointer dereference vulnerability in the MPEG-4 Form spatial-constraint handlers in src/compositor/mpeg4_form.c that lets attackers crash the process via unchecked group lookups. Attackers can supply a crafted XMT | 2026-11-13 23:17:18 | 2026-11-13 10:18:11 |
| CVE-2026-128238 | 5.3 | Scapy before 2.8.0 contains an uncontrolled recursion vulnerability in the BER/ASN.1 decoder in scapy/asn1/ber.py that allows unauthenticated remote attackers to crash parsing applications. Attackers can send a single 833-byte packet with 250 nested | 2026-11-13 23:17:18 | 2026-11-13 10:18:11 |
| CVE-2026-127088 | 8.1 | 2FAuth before 9.0.1 contains a weak password recovery vulnerability that allows unauthenticated attackers to poison reset links by forging the HTTP Host header. Attackers can request password or WebAuthn recovery emails with an attacker-controlled ho | 2026-11-13 23:17:17 | 2026-11-13 10:18:05 |
| CVE-2026-127080 | 9.9 | OpsTree BuildPiper before 2.7.0 contains an improper authorization vulnerability that allows authenticated deploy users to define arbitrary Kubernetes hostPath volumes without allow-list or policy checks. Attackers can set the host path to / in the D | 2026-11-13 23:17:17 | 2026-11-13 10:18:04 |
| CVE-2026-127076 | 6.5 | OpsTree BuildPiper before 2.7.0 contains a broken access control vulnerability that allows authenticated users to list and build from Git repositories restricted to other projects. Attackers can enumerate repositories via GET /api/v1/git_repo/?all=tr | 2026-11-13 23:17:17 | 2026-11-13 10:18:03 |
| CVE-2026-127284 | 7.5 | A security flaw has been discovered in SourceCodester Food Ordering System 1.0. This affects an unknown part of the file admin/add_category.php of the component Admin Write Handler. Performing a manipulation of the argument title/description/price/cu | 2026-11-13 23:17:17 | 2026-11-13 02:18:55 |
| CVE-2026-127279 | 7.5 | A vulnerability was detected in AIP-PUB ACPs-community up to 2.2.0. This impacts an unknown function of the file discovery-server/app/main.py of the component Discovery Server. The manipulation results in missing authentication. The attack may be lau | 2026-11-13 23:17:17 | 2026-11-13 02:18:54 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/40249
Zapisa po stranici: