React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint
CVE-2026-42342
There exists a potential DOS attack vector in React Router Framework Mode applications (as well as Remix v2.10.0 - 2.17.
#severity:high
共收录 5509 条相关情报。
← 返回所有主题React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE
CVE-2026-42211
When using React Router v7 in [Framework Mode](https://reactrouter.com/start/modes#framework), there exists a combinatio
Froxlor: BIND Zone File Injection via TXT Record Content
CVE-2026-41234
## Summary The `DomainZones.add` API endpoint does not sanitize newline characters in TXT record content. An authentica
React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets
CVE-2026-33245
When using React Router v7's unstable RSC APIs, there exists a potential client-side XSS issue in the RSC redirect handl
Docling: Unsafe Zip Extraction in EasyOCR Model Download
CVE-2026-44017
### Impact In versions `< 2.91.0`, The EasyOCR model download functionality extracted ZIP archives without validating me
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 encrypts configuration backups...
CVE-2026-36606
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 encrypts configuration backups with a hardcoded DES key
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows unauthenticated brute...
CVE-2026-36607
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows unauthenticated brute-force attacks via the TDDP
Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized...
CVE-2026-36611
Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized buffer when receiving POST r
launch-editor vulnerable to command injection via the crafted request on Windows
CVE-2024-52011
### Summary Due to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute a
QloApps through 1.7.0, fixed in commit 64e9722, contains a weak cryptographic algorithm...
CVE-2026-25861
QloApps through 1.7.0, fixed in commit 64e9722, contains a weak cryptographic algorithm vulnerability that allows attack
Fixed a VM panic caused by unbounded recursion in the grpcfuse kernel module when a container...
CVE-2026-8936
Fixed a VM panic caused by unbounded recursion in the grpcfuse kernel module when a container created deeply nested dire
Dräger Zeus Infinity Empowered (Zeus IE) and Zeus RS C500 anesthesia workstations contain a local...
CVE-2025-15653
Dräger Zeus Infinity Empowered (Zeus IE) and Zeus RS C500 anesthesia workstations contain a local security vulnerability
Dräger Core 1.0.5 and Dräger M540 Converter Service 1.0.9 contain a denial of service...
CVE-2024-14036
Dräger Core 1.0.5 and Dräger M540 Converter Service 1.0.9 contain a denial of service vulnerability that allows network-
Dräger Protector Software prior to version 6.4.2 contains a local privilege escalation...
CVE-2021-4480
Dräger Protector Software prior to version 6.4.2 contains a local privilege escalation vulnerability due to insecure fil
Dräger Protector Software prior to version 6.4.2 contains a local privilege escalation...
CVE-2021-4481
Dräger Protector Software prior to version 6.4.2 contains a local privilege escalation vulnerability due to insecure fil
Dräger Infinity Acute Care System and Standalone Infinity M540 patient monitors versions VG4.1.1,...
CVE-2022-4992
Dräger Infinity Acute Care System and Standalone Infinity M540 patient monitors versions VG4.1.1, VG4.0.3, and lower (wi
The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'order'...
CVE-2026-5073
The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'arm_directory
Improper input validation in NI-PAL may allow a local authenticated user to access arbitrary...
CVE-2026-8036
Improper input validation in NI-PAL may allow a local authenticated user to access arbitrary system memory, potentially
The Content Visibility for Divi Builder plugin for WordPress is vulnerable to Remote Code...
CVE-2026-1829
The Content Visibility for Divi Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up t
SolarWinds Web Help Desk is found to be affected by a denial-of-service vulnerability, which when...
CVE-2026-28299
SolarWinds Web Help Desk is found to be affected by a denial-of-service vulnerability, which when exploited, could cause