Improper input validation in Passwords in Google Chrome prior to 153.0.8010.36 allowed a remote...
CVE-2026-87590
Improper input validation in Passwords in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially
#cwe-20
共收录 1721 条相关情报。
← 返回所有主题Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain
### Summary Nodemailer resolves an international (IDN / non-ASCII) recipient **domain** to a different Punycode `xn--`
Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain
### Summary Nodemailer's email-address parser treats an **RFC 5322 comment** `( ... )` inside the domain as a point to
Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
CVE-2026-69352
Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
Out-of-bounds read in Windows USB Driver allows an authorized attacker to elevate privileges locally.
CVE-2026-69295
Out-of-bounds read in Windows USB Driver allows an authorized attacker to elevate privileges locally.
Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
CVE-2026-69293
Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to disclose information locally.
CVE-2026-69286
Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to disclose informatio
Heap-based buffer overflow in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to elevate privileges locally.
CVE-2026-69270
Heap-based buffer overflow in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to elevate pri
Heap-based buffer overflow in Windows USB Mass Storage Class Driver allows an unauthorized attacker to execute code over a network.
CVE-2026-68839
Heap-based buffer overflow in Windows USB Mass Storage Class Driver allows an unauthorized attacker to execute code over
An issue in the l2cap_handle_data() function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows attackers to cause a Denial of Service (DoS) via...
CVE-2026-79376
An issue in the l2cap_handle_data() function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlie
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A random number generator is used to generate security-relevant values (such as session identifiers ...
CVE-2026-62647
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A random number generator is used to genera
Affected versions of MISP insufficiently validate URLs used by dashboard widgets, particularly the Button widget. The widget's URL is stored configuration controlled by a user...
CVE-2026-86440
Affected versions of MISP insufficiently validate URLs used by dashboard widgets, particularly the Button widget. The
PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAG_String...
CVE-2022-51017
PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, all
PocketMine-MP before 4.0.6 does not validate facing values in PlayerActionPacket (for START_BREAK and CRACK_BREAK actions) or in UseItemTransactionData (typically within Invento...
CVE-2022-51015
PocketMine-MP before 4.0.6 does not validate facing values in PlayerActionPacket (for START_BREAK and CRACK_BREAK action
PocketMine-MP versions before 4.2.3 fail to validate damage metadata values in tool and armor item NBT data received from clients. Attackers can send negative or out-of-range da...
CVE-2022-51013
PocketMine-MP versions before 4.2.3 fail to validate damage metadata values in tool and armor item NBT data received fro
PocketMine-MP versions before 4.2.9 fail to properly validate NBT data types during deserialization of inventory transaction packets from clients. Attackers can send crafted inv...
CVE-2022-51012
PocketMine-MP versions before 4.2.9 fail to properly validate NBT data types during deserialization of inventory transac
PocketMine-MP before 4.2.10 fails to validate the total length of incoming chat message blobs before splitting them by newline characters, allowing attackers to send large messa...
CVE-2022-51011
PocketMine-MP before 4.2.10 fails to validate the total length of incoming chat message blobs before splitting them by n
PocketMine-MP versions before 4.4.2 fail to properly validate item IDs received from clients in itemstack NBT data. Attackers can send crafted item IDs outside the valid range t...
CVE-2022-51010
PocketMine-MP versions before 4.4.2 fail to properly validate item IDs received from clients in itemstack NBT data. Atta
PocketMine-MP before 3.26.5 and 4.0.5 Denial of Service via Skin Data
CVE-2022-51017
PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, all
PocketMine-MP before 4.0.6 Denial of Service via PlayerActionPacket
CVE-2022-51015
PocketMine-MP before 4.0.6 does not validate facing values in PlayerActionPacket (for START_BREAK and CRACK_BREAK action