🚨 CVE-2026-84185
A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption (JOSE) standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the specific key ID (kid) and may instead accept a signature made by any valid key in the set. This can allow an attacker with a valid key to bypass authorization checks in applications that rely on the key ID to identify specific tenants or users.
🎖@cveNotify
A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption (JOSE) standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the specific key ID (kid) and may instead accept a signature made by any valid key in the set. This can allow an attacker with a valid key to bypass authorization checks in applications that rely on the key ID to identify specific tenants or users.
🎖@cveNotify
Redhat
CVE-2026-84185 - Red Hat Customer Portal
CVE Details App
🚨 CVE-2026-85061
MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanitize() in src/util/dom.ts iterates elem.attributes as a live NamedNodeMap while removeAttributes() removes attributes from the same collection, shifting indexes and skipping an adjacent dangerous attribute. An attacker who controls untrusted third-party style attribution strings or user-supplied custom attributions can supply consecutive dangerous attributes, causing an attribute such as onload or ontoggle to survive sanitization and execute when the attribution control inserts the content into innerHTML. A victim must render the affected map content for the script to execute. This issue is fixed in version 6.4.1.
🎖@cveNotify
MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanitize() in src/util/dom.ts iterates elem.attributes as a live NamedNodeMap while removeAttributes() removes attributes from the same collection, shifting indexes and skipping an adjacent dangerous attribute. An attacker who controls untrusted third-party style attribution strings or user-supplied custom attributions can supply consecutive dangerous attributes, causing an attribute such as onload or ontoggle to survive sanitization and execute when the attribution control inserts the content into innerHTML. A victim must render the affected map content for the script to execute. This issue is fixed in version 6.4.1.
🎖@cveNotify
GitHub
fix: snapshot attributes in DOM.removeAttributes to avoid skipping th… · maplibre/maplibre-gl-js@1da69f3
…em (#8189)
* fix: snapshot attributes in DOM.removeAttributes to avoid skipping them
Iterating the live NamedNodeMap from elem.attributes while calling removeAttribute skips the attribute direct...
* fix: snapshot attributes in DOM.removeAttributes to avoid skipping them
Iterating the live NamedNodeMap from elem.attributes while calling removeAttribute skips the attribute direct...
🚨 CVE-2026-85062
Colord is a tiny yet powerful tool for high-performance color manipulations and conversions. Prior to 2.9.4, synchronous CSS color string matchers in src/colorModels/rgbString.ts, src/colorModels/hslString.ts, src/colorModels/hwbString.ts, src/colorModels/lchString.ts, and src/colorModels/cmykString.ts use the ambiguous numeric regular expression ([+-]?\d*.?\d+), allowing the same digits to be divided between overlapping quantifiers in quadratically many ways when malformed input is rejected. An attacker who can supply an unbounded color string to colord(), getFormat(), isEqual(), mix(), or contrast(), including through a request body, JSON field, or uploaded stylesheet, can block the processing thread with a multi-kilobyte payload. The affected matchers are parseRgbaString, parseHslaString, parseHwbaString, parseLchaString, and parseCmykaString. This issue is fixed in version 2.9.4.
🎖@cveNotify
Colord is a tiny yet powerful tool for high-performance color manipulations and conversions. Prior to 2.9.4, synchronous CSS color string matchers in src/colorModels/rgbString.ts, src/colorModels/hslString.ts, src/colorModels/hwbString.ts, src/colorModels/lchString.ts, and src/colorModels/cmykString.ts use the ambiguous numeric regular expression ([+-]?\d*.?\d+), allowing the same digits to be divided between overlapping quantifiers in quadratically many ways when malformed input is rejected. An attacker who can supply an unbounded color string to colord(), getFormat(), isEqual(), mix(), or contrast(), including through a request body, JSON field, or uploaded stylesheet, can block the processing thread with a multi-kilobyte payload. The affected matchers are parseRgbaString, parseHslaString, parseHwbaString, parseLchaString, and parseCmykaString. This issue is fixed in version 2.9.4.
🎖@cveNotify
GitHub
fix: reject malformed color strings in linear time (#141) · omgovich/colord@8701808
👑 A tiny yet powerful tool for high-performance color manipulations and conversions - fix: reject malformed color strings in linear time (#141) · omgovich/colord@8701808
🚨 CVE-2026-85063
node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and group_columns_by_name options enabled treats a duplicate __proto__ header as an existing property in packages/csv-parse/lib/api/index.js, assigns an attacker-controlled array through obj['__proto__'], and replaces the parsed record object's prototype. A malicious CSV header can therefore inject inherited array values into the returned record, hide those inherited values from JSON serialization, and affect property enumeration and type or shape checks in applications that process the record. This issue is fixed in version 7.0.2.
🎖@cveNotify
node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and group_columns_by_name options enabled treats a duplicate __proto__ header as an existing property in packages/csv-parse/lib/api/index.js, assigns an attacker-controlled array through obj['__proto__'], and replaces the parsed record object's prototype. A malicious CSV header can therefore inject inherited array values into the returned record, hide those inherited values from JSON serialization, and affect property enumeration and type or shape checks in applications that process the record. This issue is fixed in version 7.0.2.
🎖@cveNotify
GitHub
fix(csv-parse): prototype replacement reachable via columns (#497) · adaltas/node-csv@eb4d148
Co-authored-by: David Worms <david@adaltas.com>
🚨 CVE-2026-85208
A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. The affected element is the function doInsert of the file /rider/orders/controller.php?action=add of the component Order Management Controller. Performing a manipulation of the argument image results in unrestricted upload. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
🎖@cveNotify
A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. The affected element is the function doInsert of the file /rider/orders/controller.php?action=add of the component Order Management Controller. Performing a manipulation of the argument image results in unrestricted upload. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
🎖@cveNotify
GitHub
202607_vul_dir/H-12-FileUpload-RCE-RiderOrders_en.md at main · boyslikesports/202607_vul_dir
2026年7月挖的漏洞. Contribute to boyslikesports/202607_vul_dir development by creating an account on GitHub.
🚨 CVE-2026-85222
A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addon_center.cgi of the component Add-On Center. Such manipulation of the argument f_name/f_url/f_flag/f_login_user leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
🎖@cveNotify
A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addon_center.cgi of the component Add-On Center. Such manipulation of the argument f_name/f_url/f_flag/f_login_user leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
🎖@cveNotify
GitHub
WAVLINK-WN530H4-Command-Injection-in-set_add_routing/DLINK-CMD-007-vulndb.md at main · dxz0069/WAVLINK-WN530H4-Command-Injection…
submit . Contribute to dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing development by creating an account on GitHub.
🚨 CVE-2026-85458
Divide-by-zero in Xpdf 4.06 (and earlier), when a glyph in a Type 3 font has a zero height.
🎖@cveNotify
Divide-by-zero in Xpdf 4.06 (and earlier), when a glyph in a Type 3 font has a zero height.
🎖@cveNotify
🚨 CVE-2026-8862
IBM Netezza Software 11.3.0.3 through Interim Fix 002 has credentials that are hardcoded in the application source code, allowing unauthorized access to the container registry. The exposed secret enables attackers to pull private container images, potentially revealing proprietary code, configuration details, and other sensitive information.
🎖@cveNotify
IBM Netezza Software 11.3.0.3 through Interim Fix 002 has credentials that are hardcoded in the application source code, allowing unauthorized access to the container registry. The exposed secret enables attackers to pull private container images, potentially revealing proprietary code, configuration details, and other sensitive information.
🎖@cveNotify
Ibm
Security Bulletin: Vulnerabilities exists in IBM Netezza Software
Vulnerabilities identified in IBM Netezza Software have been addressed in version 11.3.1.3.
🚨 CVE-2026-9036
IBM Netezza Software 11.3.0.3 through Interim Fix 002 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques.
🎖@cveNotify
IBM Netezza Software 11.3.0.3 through Interim Fix 002 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques.
🎖@cveNotify
Ibm
Security Bulletin: Vulnerabilities exists in IBM Netezza Software
Vulnerabilities identified in IBM Netezza Software have been addressed in version 11.3.1.3.
🚨 CVE-2026-9736
IBM Netezza Software 11.3.0.3 through Interim Fix 002 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.
🎖@cveNotify
IBM Netezza Software 11.3.0.3 through Interim Fix 002 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.
🎖@cveNotify
Ibm
Security Bulletin: Vulnerabilities exists in IBM Netezza Software
Vulnerabilities identified in IBM Netezza Software have been addressed in version 11.3.1.3.
🚨 CVE-2026-9744
IBM Netezza Software 11.3.0.3 through Interim Fix 002 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques.
🎖@cveNotify
IBM Netezza Software 11.3.0.3 through Interim Fix 002 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques.
🎖@cveNotify
Ibm
Security Bulletin: Vulnerabilities exists in IBM Netezza Software
Vulnerabilities identified in IBM Netezza Software have been addressed in version 11.3.1.3.
🚨 CVE-2026-9745
IBM Netezza Software 11.3.0.3 through Interim Fix 002 has operations that are performed without validating bucket ownership using the ExpectedBucketOwner parameter. This omission may allow a remote attacker to exploit misconfigurations or naming collisions to redirect application requests to an unintended S3 bucket under their control.
🎖@cveNotify
IBM Netezza Software 11.3.0.3 through Interim Fix 002 has operations that are performed without validating bucket ownership using the ExpectedBucketOwner parameter. This omission may allow a remote attacker to exploit misconfigurations or naming collisions to redirect application requests to an unintended S3 bucket under their control.
🎖@cveNotify
Ibm
Security Bulletin: Vulnerabilities exists in IBM Netezza Software
Vulnerabilities identified in IBM Netezza Software have been addressed in version 11.3.1.3.
🚨 CVE-2026-15563
A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations.
🎖@cveNotify
A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations.
🎖@cveNotify
🚨 CVE-2026-69414
Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "ShieldBreak ".
🎖@cveNotify
Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "ShieldBreak ".
🎖@cveNotify
🚨 CVE-2026-64195
There is an out-of-bounds write vulnerability in DASYLab due to lack of proper validation of user-supplied data. Successful exploitation requires an attacker to get a user to open a specially crafted .DSB file. This issue affects all versions before 2026.0.0.
🎖@cveNotify
There is an out-of-bounds write vulnerability in DASYLab due to lack of proper validation of user-supplied data. Successful exploitation requires an attacker to get a user to open a specially crafted .DSB file. This issue affects all versions before 2026.0.0.
🎖@cveNotify
measX - Measurement System Experts
Out-of-Bounds Write Vulnerabilities in DASYLab
measX ist seit über 40 Jahren Spezialist für Mess-, Prüf- und Auswerteaufgaben und bietet individuelle Systeme, Software und Dienstleistungen für Forschung, Entwicklung, Qualitätssicherung und Produktion – für nachhaltige Wettbewerbsvorteile.
🚨 CVE-2026-64196
There is an out-of-bounds write vulnerability in DASYLab due to improper validation of user-supplied data, resulting in a write past the end of an allocated heap. Successful exploitation requires an attacker to get a user to open a specially crafted .DSB file. This issue affects all versions before 2026.0.0.
🎖@cveNotify
There is an out-of-bounds write vulnerability in DASYLab due to improper validation of user-supplied data, resulting in a write past the end of an allocated heap. Successful exploitation requires an attacker to get a user to open a specially crafted .DSB file. This issue affects all versions before 2026.0.0.
🎖@cveNotify
measX - Measurement System Experts
Out-of-Bounds Write Vulnerabilities in DASYLab
measX ist seit über 40 Jahren Spezialist für Mess-, Prüf- und Auswerteaufgaben und bietet individuelle Systeme, Software und Dienstleistungen für Forschung, Entwicklung, Qualitätssicherung und Produktion – für nachhaltige Wettbewerbsvorteile.
🚨 CVE-2026-64197
There is an out-of-bounds write vulnerability in DASYLab due to improper validation of user-supplied data, resulting in a write past the end of an allocated data structure. Successful exploitation requires an attacker to get a user to open a specially crafted .DSB file. This issue affects all versions before 2026.0.0.
🎖@cveNotify
There is an out-of-bounds write vulnerability in DASYLab due to improper validation of user-supplied data, resulting in a write past the end of an allocated data structure. Successful exploitation requires an attacker to get a user to open a specially crafted .DSB file. This issue affects all versions before 2026.0.0.
🎖@cveNotify
measX - Measurement System Experts
Out-of-Bounds Write Vulnerabilities in DASYLab
measX ist seit über 40 Jahren Spezialist für Mess-, Prüf- und Auswerteaufgaben und bietet individuelle Systeme, Software und Dienstleistungen für Forschung, Entwicklung, Qualitätssicherung und Produktion – für nachhaltige Wettbewerbsvorteile.
🚨 CVE-2026-64198
There is an out-of-bounds read vulnerability in DASYLab due to improper validation of user-supplied data. This results in a read a few bytes past the end of an allocated heap buffer during file handling. Successful exploitation requires an attacker to get a user to open a specially crafted .DSB file. This issue affects all versions before 2026.0.0.
🎖@cveNotify
There is an out-of-bounds read vulnerability in DASYLab due to improper validation of user-supplied data. This results in a read a few bytes past the end of an allocated heap buffer during file handling. Successful exploitation requires an attacker to get a user to open a specially crafted .DSB file. This issue affects all versions before 2026.0.0.
🎖@cveNotify
measX - Measurement System Experts
Out-of-Bounds Read Vulnerabilities in DASYLab
measX ist seit über 40 Jahren Spezialist für Mess-, Prüf- und Auswerteaufgaben und bietet individuelle Systeme, Software und Dienstleistungen für Forschung, Entwicklung, Qualitätssicherung und Produktion – für nachhaltige Wettbewerbsvorteile.
🚨 CVE-2026-64199
There is an out-of-bounds read vulnerability in DASYLab due to improper validation of user-supplied data. This results in a read outside the bounds of an allocated data structure. Successful exploitation requires an attacker to get a user to open a specially crafted .DSB file. This issue affects all versions before 2026.0.0.
🎖@cveNotify
There is an out-of-bounds read vulnerability in DASYLab due to improper validation of user-supplied data. This results in a read outside the bounds of an allocated data structure. Successful exploitation requires an attacker to get a user to open a specially crafted .DSB file. This issue affects all versions before 2026.0.0.
🎖@cveNotify
measX - Measurement System Experts
Out-of-Bounds Read Vulnerabilities in DASYLab
measX ist seit über 40 Jahren Spezialist für Mess-, Prüf- und Auswerteaufgaben und bietet individuelle Systeme, Software und Dienstleistungen für Forschung, Entwicklung, Qualitätssicherung und Produktion – für nachhaltige Wettbewerbsvorteile.
🚨 CVE-2026-64200
There is an out-of-bounds read vulnerability in DASYLab due to improper validation of user-supplied data. This results in a read a past the end of an allocated heap buffer during string conversion. Successful exploitation requires an attacker to get a user to open a specially crafted .DSB file. This issue affects all versions before 2026.0.0.
🎖@cveNotify
There is an out-of-bounds read vulnerability in DASYLab due to improper validation of user-supplied data. This results in a read a past the end of an allocated heap buffer during string conversion. Successful exploitation requires an attacker to get a user to open a specially crafted .DSB file. This issue affects all versions before 2026.0.0.
🎖@cveNotify
measX - Measurement System Experts
Out-of-Bounds Read Vulnerabilities in DASYLab
measX ist seit über 40 Jahren Spezialist für Mess-, Prüf- und Auswerteaufgaben und bietet individuelle Systeme, Software und Dienstleistungen für Forschung, Entwicklung, Qualitätssicherung und Produktion – für nachhaltige Wettbewerbsvorteile.
🚨 CVE-2026-85223
A vulnerability was found in D-Link DNS-340L 1.01B04. Affected by this issue is some unknown functionality of the file /cgi-bin/dropbox.cgi of the component CGI Handler. Performing a manipulation of the argument callback_url/sync_interval results in os command injection. The attack can be initiated remotely. The exploit has been made public and could be used.
🎖@cveNotify
A vulnerability was found in D-Link DNS-340L 1.01B04. Affected by this issue is some unknown functionality of the file /cgi-bin/dropbox.cgi of the component CGI Handler. Performing a manipulation of the argument callback_url/sync_interval results in os command injection. The attack can be initiated remotely. The exploit has been made public and could be used.
🎖@cveNotify
GitHub
WAVLINK-WN530H4-Command-Injection-in-set_add_routing/DLINK-CMD-008-vulndb.md at main · dxz0069/WAVLINK-WN530H4-Command-Injection…
submit . Contribute to dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing development by creating an account on GitHub.