| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-70640 | 7.0 | llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI wrapper where bench_1model() and free_1context() lack synchronization, allowing Thread A to operate on freed memory while Thread B con | 2026-10-29 21:17:31 | 2026-08-06 22:18:28 |
| CVE-2026-70639 | 5.5 | llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the LLaMA-Android JNI wrapper where the bench_1model() function fails to validate the model context pointer before dereferencing it. Attackers can supply a malic | 2026-10-29 21:17:31 | 2026-08-06 22:18:28 |
| CVE-2026-6877 | - | ServiceNow has addressed a domain separation bypass security issue that was identified in the ServiceNow SR – CSM – Task Plan Templates Store application. This vulnerability could enable an authenticated user with a specific role to create records in | 2026-10-29 21:17:30 | 2026-10-29 19:17:26 |
| CVE-2026-70638 | 7.8 | llama.cpp builds b1886 through b7445 contain an integer overflow vulnerability in the LLaMA-Android JNI wrapper where the new_1batch() function multiplies sizeof(llama_seq_id) by an attacker-controlled n_seq_max parameter without overflow validation, | 2026-10-29 21:17:30 | 2026-08-06 22:18:28 |
| CVE-2026-6942 | 9.8 | radare2-mcp version 1.6.0 and earlier contains an os command injection vulnerability that allows remote attackers to execute arbitrary commands by bypassing the command filter through shell metacharacters in user-controlled input passed to r2_cmd_str | 2026-10-29 21:17:30 | 2026-04-23 21:16:06 |
| CVE-2026-6257 | 9.1 | Vvveb CMS before 1.0.8.2 contains a remote code execution vulnerability in its media management functionality where a missing return statement in the file rename handler allows authenticated attackers to rename files to blocked extensions .php or .ht | 2026-10-29 21:17:30 | 2026-04-20 20:16:49 |
| CVE-2026-67214 | 5.9 | nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negati | 2026-10-29 21:17:29 | 2026-07-29 14:16:35 |
| CVE-2026-65902 | 6.1 | DOMPurify before 3.4.7 passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sanitize is called wi | 2026-10-29 21:17:29 | 2026-07-23 14:18:05 |
| CVE-2026-65689 | 9.8 | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its database download feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a craft | 2026-10-29 21:17:29 | 2026-07-23 14:18:03 |
| CVE-2026-65014 | 5.3 | n8n before 2.28.0 (and before 2.27.4 on the 2.27.x branch) registers the DELETE /${restEndpoint}/test-webhook/:id endpoint before authentication middleware is applied, allowing any unauthenticated network caller who knows a workflow ID to cancel that | 2026-10-29 21:17:29 | 2026-07-22 12:18:18 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/39855
Zapisa po stranici: