13,591 results · Clear filters · Feed
-
High 8.8CVE-2026-96230 Public exploit
ASP.NET Core Remote Code Execution Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
-
High 7.5
ASP.NET Core Elevation of Privilege Vulnerability
Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
-
High 8.8
.NET Remote Code Execution Vulnerability
Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
-
High 8.8
.NET Framework Elevation of Privilege Vulnerability
Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network.
-
High 7.5
.NET Denial of Service Vulnerability
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
-
High 8.8
.NET Remote Code Execution Vulnerability
Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
-
High 8.8
.NET Remote Code Execution Vulnerability
Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code over a network.
-
High 7.5
.NET Information Disclosure Vulnerability
Out-of-bounds read in .NET allows an unauthorized attacker to disclose information over a network.
-
High 8.8
.NET Remote Code Execution Vulnerability
Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
-
High 7.4
Active Directory Federation Services (AD FS) Spoofing Vulnerability
Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
-
High 7.8
.NET Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
-
High 7.5
ASP.NET Core Denial of Service Vulnerability
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
-
High 8.1
.NET and Visual Studio Remote Code Execution Vulnerability
Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
-
High 7.5
.NET Denial of Service Vulnerability
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
-
High 8.8
ASP.NET Core Remote Code Execution Vulnerability
Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
-
High 7.5
.NET Denial of Service Vulnerability
Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.
-
High 7.5
ASP.NET Core Denial of Service Vulnerability
Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.
-
High 7.5
.NET Denial of Service Vulnerability
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
-
High 7.5
.NET Denial of Service Vulnerability
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
-
High 7.5
.NET Denial of Service Vulnerability
Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.
-
High 7.5
ASP.NET Core Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
-
High 7.5
ASP.NET Core Denial of Service Vulnerability
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
-
High 8.1
ASP.NET Core Elevation of Privilege Vulnerability
Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
-
High 7.5
ASP.NET Core Denial of Service Vulnerability
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
-
High 7.5
Decompression bomb in `ruzstd`: a tiny input can exhaust memory (OOM)
A crafted `.zst` input under 128 KB can force `ruzstd` to allocate several gigabytes at once, crashing the process with an out-of-memory condition. Since `ruzstd` is a decoder for untrusted input, a single small file is enough to take down anything decoding i…
-
High 7.5
Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage
Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an attacker-controlled request body and synchronizes it before validating the body digest and cryptogr…
-
High 8.2
Tina: Code injection via unescaped Git branch name in generated client source
Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD, incorporates the raw value into the API URL, and interpolates that URL into JavaScript string literals in pa…
-
High 7.6
@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS
Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js assigns a rich-text node.url value directly to an anchor href without validating the URL scheme. A content author …
-
High 7.5
Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth
Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against /dav, /.well-known, and /feeds rou…
-
High 7.5
Vikunja before 2.6.0 Privilege Escalation via Link Share Hash
Vikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share read endpoints, allowing read-only members to obtain the share's secret credential. Attackers can exchange the disclosed hash for a link-share JWT at the share…
-
High 7.5
Vikunja before 2.6.0 Authentication Bypass via Unthrottled API
Vikunja versions before 2.6.0 fail to apply rate limiting to /api/v2 public authentication endpoints including login, register, password-reset, and OAuth token routes. Remote unauthenticated attackers can perform unbounded credential guessing, account enumera…
-
High 8.1
Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access
Vikunja is an open-source self-hosted task management platform. Versions prior to 2.4.0 store password-reset, email-confirmation, and account-deletion tokens in the `user_tokens` table in plaintext. If an attacker gains read access to the database through a b…
-
High 7.5CVE-2026-62367 Public exploit
Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover
Vikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an administrator enables the per-provider `emailfallback` option on an OpenID Connect provider, Vikunja links an SSO login to a pre-existing local (username+…
-
High 7.5
ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service
ageLANServer provides a cross-platform web server and launcher for offline multiplayer in several Age of Empires and Age of Mythology games. Prior to version 1.15.2, the AoE3 POST /game/cloud/getFileURL handler in the bundled game server has no request body s…
-
High 7.5
Vikunja through 2.4.0 Principal-Type Confusion via LinkSharing
Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims…
-
High 7.5
yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels
yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-controlled r.Method value directly as the method label for yopass_http_requests_total …
-
High 8.1
Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID Collision
Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID() interface, a link-share JWT whose nume…
-
High 8.1
Vikunja: Scoped API token can mint unrestricted OAuth session credentials
Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the `oauth.authorize` permission can call `POST /api/v1/oauth/authorize`, obtain an OAuth authorization code, and exchange the code at `POST /api/v…
-
High 8.1
pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password
## Summary `Api.getUserData` (legacy) and `Api.get_userdata` are declared with `@permission(Perms.ANY)` and are reachable at `/api/getUserData` and `/api/get_userdata`. Because `Perms.ANY == 0` and pyLoad's permission check is a bitmask AND, that gate is a no…
-
High 7.5
pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session
An admin who revokes a user's privileges through the REST API does not actually revoke them, because the session carrying those privileges is never invalidated. pyLoad authorizes each request from values copied into the Flask session at login. set_session in …