Aggregator

原域名已变更且将在2024年彻底废弃，请访问 https://govuln.com/news/ 查看新的RSS订阅

Currently trending CVE - Hype Score: 11 - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, ...

Currently trending CVE - Hype Score: 18

Currently trending CVE - Hype Score: 18 - Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.

Currently trending CVE - Hype Score: 1 - A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting ...

Currently trending CVE - Hype Score: 25 - In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it. Another cpu can concurrently ...

Currently trending CVE - Hype Score: 11 - PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may ...

Currently trending CVE - Hype Score: 11 - PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request ...

Currently trending CVE - Hype Score: 3 - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially ...

Currently trending CVE - Hype Score: 12 - A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code ...

Currently trending CVE - Hype Score: 16 - Microsoft Outlook Remote Code Execution Vulnerability

A vulnerability was found in lia Back-office Default Twig Template up to 1.1.0. It has been rated as problematic. The affected element is an unknown function of the file /admin/product/combinations/update. The manipulation leads to cross-site request forgery. This vulnerability is documented as CVE-2026-120249. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

A vulnerability was found in Thelia up to 3.1.0. It has been declared as problematic. Impacted is an unknown function of the component Image Upload. Executing a manipulation of the argument logo_file/banner_file can lead to cross site scripting. This vulnerability is registered as CVE-2026-120248. It is possible to launch the attack remotely. No exploit is available. It is recommended to upgrade the affected component.

A vulnerability was found in cgohlke imagecodecs up to 2026.10.10. It has been classified as problematic. This issue affects the function decode_jpegsof3 of the component Lossless JPEG Define Huffman Table Parser. Performing a manipulation results in stack-based buffer overflow. This vulnerability is cataloged as CVE-2026-120252. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability was found in cgohlke imagecodecs up to 2026.10.10 and classified as problematic. This vulnerability affects the function ccitt_fax4_decode_size of the component Ccittfax4 Codec. Such manipulation leads to infinite loop. This vulnerability is listed as CVE-2026-120251. The attack must be carried out locally. There is no available exploit.

A vulnerability has been found in FFmpeg up to 9.0.2 and classified as problematic. This affects the function cdxl_decode_ham8/cdxl_decode_ham6 of the component CDXL decoder. This manipulation causes uninitialized resource. This vulnerability is tracked as CVE-2026-120246. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability, which was classified as problematic, was found in marketcalls OpenAlgo. Affected by this issue is some unknown functionality of the file utils/email_utils.py of the component Email Utils. The manipulation results in improper certificate validation. This vulnerability is identified as CVE-2026-120250. The attack can be executed remotely. There is not any exploit available. You should upgrade the affected component.

A vulnerability, which was classified as problematic, has been found in FFmpeg up to 9.0.2. Affected by this vulnerability is the function kempf_restore_buf of the component Go2Meeting decoder. The manipulation leads to uninitialized pointer. This vulnerability is referenced as CVE-2026-120243. Remote exploitation of the attack is possible. No exploit is available.