| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-129142 | 5.4 | paicoding commit 766c48b through commit 903adce contains a stored cross-site scripting vulnerability in payment notifications, where NotifyMsgListener inserts the payer's display name unescaped and notify-system-item.html renders it via th:utext. Aut | 2026-11-13 22:17:24 | 2026-11-13 18:17:38 |
| CVE-2026-16662 | 2.4 | boot_save_boot_status() in boot/bootutil/src/boot_record.c reads the image's EXPECTED_HASH_TLV into a stack buffer image_hash[IMAGE_HASH_SIZE] that is never zero-initialised. The TLV handler validates only the upper bound (len > sizeof(image_hash)) a | 2026-11-13 22:17:24 | 2026-11-13 02:18:57 |
| CVE-2026-128886 | 6.2 | A flaw was found in dbus when configured with the nonce-tcp transport. An unauthenticated attacker able to connect to an exposed listener can cause a Denial of Service (DoS) by opening a connection and withholding the expected authentication token. B | 2026-11-13 22:17:23 | 2026-11-13 22:17:23 |
| CVE-2026-128885 | 5.5 | A flaw was found in D-Bus. In configurations where the daemon falls back to using the Unix select() mechanism for event monitoring, it does not verify whether file descriptor numbers exceed allocated limits. A local attacker can exploit this flaw by | 2026-11-13 22:17:23 | 2026-11-13 21:17:45 |
| CVE-2026-128129 | - | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, aiohttp buffers all additional connection data received while a request marked for upgrade, such as a WebSocket handshake, is being handled, without a si | 2026-11-13 22:17:23 | 2026-11-13 21:17:44 |
| CVE-2026-128125 | - | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Set-Cookie parsing treats unrecognized name=value attributes as additional cookies, while CookieJar does not limit the number of cookies stored or sent. | 2026-11-13 22:17:23 | 2026-11-13 21:17:44 |
| CVE-2026-128121 | 5.9 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to @sveltejs/adapter-vercel 6.3.5 and 7.0.2 and @sveltejs/adapter-static 3.0.11 and 4.0.1, an attacker-influenced link crawled during prerenderin | 2026-11-13 22:17:23 | 2026-11-13 20:18:56 |
| CVE-2026-128117 | 5.9 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to versions 2.70.4 and 3.1.1, the reroute hook could rewrite an invalid percent-encoded pathname into a valid route and reach a comparison that de | 2026-11-13 22:17:23 | 2026-11-13 20:18:56 |
| CVE-2026-129123 | 8.8 | C-Kermit 8.0.200 before 11.1.515 contains a buffer overflow vulnerability in getreply() in ckcftp.c that allows malicious FTP servers to overwrite client memory by sending overlong security replies. Attackers controlling or intercepting an FTP server | 2026-11-13 22:17:23 | 2026-11-13 17:17:29 |
| CVE-2026-129119 | 6.5 | C-Kermit from 6.0.192 before 11.1.515 contains a file collision protection bypass that allows malicious senders to append data to existing files by marking transfers as RESEND. The gattr() function in ckcfn3.c clears the REJECT discard flag and switc | 2026-11-13 22:17:23 | 2026-11-13 17:17:28 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/40249
Zapisa po stranici: