CVE Notifier

CVE-2026-71537 CWE-362 6.5

Paymenter: Credit-refund double-spend race condition in service downgrade (doUpgrade)

Paymenter is a free and open-source webshop solution for management of hosting services. Prior to 1.5.7, app/Livewire/Services/Upgrade.php::doUpgrade() relies on Service::upgradable to check for a pending service upgrade…

cve.org Paymenter:Paymenter 1 hari lalu

CVE-2026-85058 CWE-862 7.5

Moquette: Missing Authorization in io.moquette:moquette-broker

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client-controlled Last Will message through publish2Subscribers without invoking the authorizator.canWrite check used by nor…

cve.org moquette-io:moquette 1 hari lalu

CVE-2026-63445 CWE-22 N/A

Perses: Unvalidated project parameter enables filesystem path traversal

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the re…

cve.org perses:perses 1 hari lalu

CVE-2026-63199 CWE-862 N/A

Perses: Missing authorization in datasource proxy allows cross-scope secret disclosure

Perses is an open-source dashboard and visualization project for observability data. From 0.43.0 until 0.54.0-rc.0, the datasource creation and unsaved datasource proxy paths authorize the caller on a Datasource or Globa…

cve.org perses:perses 1 hari lalu

CVE-2026-63458 CWE-639 N/A

Perses project query parameter authorization bypass exposes cross-project resources

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can supply another project through the project query pa…

cve.org perses:perses 1 hari lalu

CVE-2026-32641 CWE-248 7.5

Parseable: Unauthenticated Denial of Service via panic in Kinesis header parsing middleware

Parseable is a log analytics platform built for high-volume data ingestion and analysis. Prior to 3.0.0, src/handlers/http/middleware.rs uses unwrap() while parsing the x-amz-firehose-common-attributes header before auth…

cve.org parseablehq:parseable 1 hari lalu

CVE-2026-93759 CWE-94 8.6

Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist

Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value…

cve.org MongoDB · Inc.:Mongoid 1 hari lalu

CVE-2026-69184 CWE-407 7.5

c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains

c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can…

cve.org c-ares:c-ares 1 hari lalu

CVE-2026-69186 CWE-400 5.3

c-ares: Memory-amplification denial of service via unvalidated DNS header record counts

c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that the DNS response contains enough bytes for the clai…

cve.org c-ares:c-ares 1 hari lalu

CVE-2026-61552 CWE-94 7.2

Icinga 2 DSL Injection via Unescaped Import Template Name

Icinga 2 is an open source monitoring system. From 2.4 until 2.14.9, 2.15.4, and 2.16.2, the /v1/objects API writes attacker-controlled template names into generated configuration without escaping them. An authenticated …

cve.org Icinga:icinga2 1 hari lalu

CVE-2026-93760 CWE-943 8.2

NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard

Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In an application that forwards externally supplied filter para…

cve.org MongoDB · Inc.:Mongoid 1 hari lalu

CVE-2026-61551 CWE-674 8.6

Icinga 2: Stack overflow via deeply nested JSON objects

Icinga 2 is an open source monitoring system. Prior to 2.14.9, 2.15.4, and 2.16.2, parsing deeply nested JSON can exhaust the call stack because nesting depth is not bounded. The affected JSON parsing paths are reachable…

cve.org Icinga:icinga2 1 hari lalu