CVE Notifier

CVE-2026-81516 CWE-755 7.5

Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS)

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. From 4.0.0 until 4.3.0, ConsulDiscoveryClient constructs ConsulServiceInstance objects by parsi…

cve.org SteeltoeOSS:security-advisories 5 hari lalu

CVE-2026-81868 CWE-288 6.5

Steeltoe: Header-forwarded client cert lacks proof of private-key possession

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePol…

cve.org SteeltoeOSS:security-advisories 5 hari lalu

CVE-2026-75523 CWE-200 5.9

Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, the Steeltoe.Management.Endpoint /actuator/httpexchanges endpoint passes record…

cve.org SteeltoeOSS:security-advisories 5 hari lalu

CVE-2026-85715 CWE-789 7.5

ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion

ExifReader is a JavaScript Exif information parser. Prior to 4.41.1, ExifReader parses attacker-controlled HEIC or AVIF ISO-BMFF files in getItems() within src/image-header-iso-bmff-iloc.js and trusts iloc itemCount and …

cve.org mattiasw:ExifReader 5 hari lalu

CVE-2026-86864 CWE-88 8.8

pgAdmin 4: Argument and connection-string injection via the database field in the Backup tool

pgAdmin 4's Backup tool appended the client-supplied 'database' field from the /backup/job/<sid>/object request to the pg_dump argument vector as a bare trailing positional argument, without validation. Because pg_dump p…

cve.org pgadmin.org:pgAdmin · 4 5 hari lalu

CVE-2026-86863 CWE-290 9.8

pgAdmin 4: Authentication bypass via a client-controlled identity header in Webserver authentication mode

pgAdmin 4's Webserver authentication source is intended to accept an identity asserted by the web server or reverse proxy in front of pgAdmin, delivered through the WSGI/CGI environment. WebserverAuthentication.get_user(…

cve.org pgadmin.org:pgAdmin · 4 5 hari lalu

CVE-2026-86862 CWE-88 6.5

pgAdmin 4: Connection-string injection via the database field in the Restore and Maintenance tools

pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbname option given to pg_restore and psql. libpq expands a database name containing an equals sign int…

cve.org pgadmin.org:pgAdmin · 4 5 hari lalu

CVE-2026-86861 CWE-367 5.9

pgAdmin 4: File Manager save_file writes through a symbolic link planted after the containment check

pgAdmin 4's File Manager save_file endpoint, which backs saving from the Query Tool and ERD, validated the requested path with Filemanager.check_access_permission() and then opened the file for writing with a plain open(…

cve.org pgadmin.org:pgAdmin · 4 5 hari lalu

CVE-2026-92881 CWE-369 4.3

vgmstream AWB parser awb.c init_vgmstream_awb_memory divide by zero

A security vulnerability has been detected in vgmstream. The affected element is the function init_vgmstream_awb_memory of the file src/meta/awb.c of the component AWB parser. Such manipulation leads to divide by zero. T…

cve.org n/a:vgmstream 5 hari lalu

CVE-2026-56795 CWE-427 8.2

CVE-2026-56795

Dell Server Update Utility, versions prior to 26.07.01, contains an Uncontrolled Search Path Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Cod…

cve.org Dell:Driver · Pack · For 5 hari lalu

CVE-2026-85999 CWE-400 5.3

Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, selector_iter in src/soupsieve/css_parser.py trims the raw selector with RE_WS_END, an end-anchored WSC whitespace-and-comment…

cve.org facelessuser:soupsieve 5 hari lalu

CVE-2026-86000 CWE-400 5.3

Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, the selector parser in src/soupsieve/css_parser.py defines IDENTIFIER with adjacent quantified groups over overlapping charact…

cve.org facelessuser:soupsieve 5 hari lalu