A vulnerability exists in CGI versions before 5.00 for Perl where upload filenames are returned with any client-supplied path, including directory traversal sequences like ../ and Windows-style paths. This could potentially lead to security issues related to path handling.
CVE-2026-120644 is a vulnerability in CGI::Cookie versions before 5.00 for Perl that allows cookie attribute injection through unvalidated path, domain, and expires parameters. This flaw relates to improper input validation leading to potential manipulation of cookie attributes.
CVE-2026-120642 is a vulnerability affecting CGI versions before 5.00 for Perl, where request-derived values are returned untainted under taint mode. This behavior can lead to improper handling of potentially unsafe input data in Perl CGI scripts.
A vulnerability in CGI versions before 5.00 for Perl allows HTTP header injection via entity decoding after the newline check in headers. This flaw relates to improper handling of HTTP headers, potentially enabling injection attacks.
CVE-2026-120636 affects CGI versions before 5.00 for Perl, allowing open redirect and script injection vulnerabilities via URLs constructed from REQUEST_URI in certain parameters. The vulnerability is classified under CWE-601 (Open Redirect). The affected version explicitly stated is version 3.0. No CVSS score or detailed impact information is provided. No patch or remediation details are available in the input data.
A vulnerability exists in CGI versions before 5.00 for Perl that allows form fields to be smuggled past proxies and web application firewalls (WAFs) via multipart parsing. This could potentially bypass security controls that rely on proper parsing of multipart form data. The affected version explicitly stated is version 3.0. No CVSS score or detailed impact information is provided.
A denial of service vulnerability exists in CGI versions before 5.00 for Perl, where submitted values are used as a regular expression for optgroup selection. This can cause the application to become unresponsive or crash when processing crafted input.
CVE-2026-92824 is an out-of-bounds read vulnerability in libmodulemd version 3.0 when emitting rpm-map artifacts. This flaw could potentially lead to memory access errors during processing.
A vulnerability in json-glib version 3.0 causes an infinite loop in the function json_path_query() when a negative jsonpath slice step is used. This flaw is identified as CWE-835 (Loop with Unreachable Exit Condition).
A vulnerability identified as CVE-2026-114456 affects multiple Snowflake client drivers due to missing origin validation in the externalbrowser authenticator callback. This flaw relates to improper validation of the origin in authentication callbacks, categorized under CWE-346. The affected version explicitly stated is version 3.0. No CVSS score or detailed impact description is provided.
A denial of service vulnerability exists in the Hivex component of Microsoft software due to an out-of-bounds read during big-data block processing. This flaw can cause the affected software to crash or become unresponsive when processing specially crafted data. The issue is identified as CWE-125 (out-of-bounds read) and affects version 3.0 of the product. No CVSS score or detailed impact metrics are provided. No known exploits are reported in the wild, and no patch information is available at this time.
A heap overflow vulnerability exists in the git-credential-wincred OAuth Store component of Git for Windows version 3.0. This vulnerability is identified as CWE-787 and has been published with no CVSS score or known exploits in the wild as of the publication date.
A heap overflow vulnerability exists in the git-credential-wincred Erase Path component of Git for Windows version 3.0. This flaw is identified as CWE-787 (Out-of-bounds Write). No CVSS score or detailed impact information is provided, and no known exploits are reported in the wild.
A vulnerability in FRRouting's ospf6d component causes it to fail to enforce that all OSPFv3 packets use IPv6 link-local addresses. This could lead to protocol enforcement issues in OSPFv3 implementations.
A vulnerability identified as CVE-2026-121520 involves a malicious client being able to set an extended attribute (xattr) value outside of the BuildKit state directory in Microsoft software version 3.0. The description and details are minimal, with no CVSS score or detailed impact information provided.
CVE-2026-112910 concerns a vulnerability in Microsoft software version 3.0 where the WindowsFileLock component ignores the specified mode (0o600) for lock files, causing the ReadWriteLock database to inherit the directory's access control list (ACL) instead. This behavior can lead to improper file permissions.
A stack buffer overflow vulnerability exists in ntopng version 3.0 within the nDPI custom category detection component. This flaw could allow remote code execution if exploited with crafted input.
CVE-2026-82413 is an authenticated OS command injection vulnerability in ntopng version 3.0. It involves the vulnerability-scan feature's scan_ports parameter, which improperly handles input, allowing non-admin authenticated users to execute arbitrary operating system commands.
A critical security vulnerability (CVE-2025-55754) affects the wso2mi package due to improper neutralization of escape, meta, or control sequences in Apache Tomcat. This flaw can lead to significant impact on confidentiality, integrity, and availability. Versions prior to 4.3.0-r0, 4.4.0-r0, and 4.5.0-r0 are affected. A patch is available in these fixed versions.
A security vulnerability identified as CVE-2025-5878 affects the wso2mi package due to an issue in the ESAPI esapi-java-legacy component. The vulnerability has a high severity score of 7.3 and impacts confidentiality, integrity, and availability. Fixed versions are available starting from 4.3.0-r0, 4.4.0-r0, and 4.5.0-r0.