Security Check

security.bloxprod.io

Schwachstellen, die jetzt zählen.

CVE für Linux-Server, Android, Apple-Telefone, Windows, Browser, Krypto-Wallets und übrige Software. Ein Klick auf den Titel öffnet das Original beim Herausgeber.

11808Artikel
1555Kritisch
6041Hoch
1779Aktiv ausgenutzt
Alle StufenKritischHochMittelNiedrigAktiv ausgenutzt
Hoch 7.5Software

ag-psd is a JavaScript library for reading and writing Photoshop Document files.

CVE-2026-635013. Nov 2026

ag-psd is a JavaScript library for reading and writing Photoshop Document files. Prior to 31.0.3, readPsd() accepts a totalMemoryLimit for parsing untrusted PSD files, but decodeLayerImageData expects a differently named memoryLimit property and therefore passes an undefined limit to createImageDataBitDepth. An attacker who can supply a PSD to an application with layer decoding enabled can use attacker-controlled layer dimensions to trigger an allocation larger than the…

Original bei NVDAlle Quellen (1)
Hoch 7.2Software

Chamilo LMS is an open-source learning management system.

CVE-2026-451463. Nov 2026

Chamilo LMS is an open-source learning management system. Prior to 1.11.40 and 2.0.1, an authenticated administrator can call the get_sessions action in /main/inc/ajax/model.ajax.php with _search=true and a crafted JSON filters parameter whose groupOp field contains SQL syntax. Because groupOp is not restricted to the expected AND or OR operators before it is incorporated into query logic, attacker-controlled input is interpreted by the database and enables blind or…

Original bei NVDAlle Quellen (1)
Hoch 8.1Linux-Server

nut: nut: Arbitrary command execution via unsanitized alarm notifications in upsmon

CVE-2026-54161nut3. Nov 2026

Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. From 2.8.3 to 2.8.5, upsmon in clients/upsmon.c inserts the server-supplied ups.alarm value into shell commands executed by notify(), async_notify(), and wall(). When a monitored device reports an ALARM state and an operator has configured NOTIFYCMD with EXEC in NOTIFYFLAG ALARM, shell metacharacters in the alarm text are evaluated on…

Original bei Red HatAlle Quellen (2)
Hoch 8.2Software

Logging Redactor is a Python library designed to redact sensitive data in logs based on regex patterns and / or dictionary keys.

CVE-2026-634173. Nov 2026

Logging Redactor is a Python library designed to redact sensitive data in logs based on regex patterns and / or dictionary keys. Prior to 0.0.7, personally identifiable information returned by custom object __str__ or __repr__ methods is not redacted when such non-primitive objects are logged, causing sensitive values to appear in logs that are expected to mask them. This issue is fixed in version 0.0.7.

Original bei NVDAlle Quellen (1)
Hoch 7.3Software

traQ is a messenger application built for Digital Creators Club traP.

CVE-2026-631983. Nov 2026

traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, OAuth2 silent authorization requests using prompt=none with an empty or omitted scope parameter check prior consent against the empty requested scope set even though all scopes registered for the client become eligible for issuance. An attacker who controls an OAuth client capable of receiving authorization codes can target a user who previously consented to only some client scopes and…

Original bei NVDAlle Quellen (1)
Hoch 7.3Software

traQ is a messenger application built for Digital Creators Club traP.

CVE-2026-631973. Nov 2026

traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQ_STORAGE_TYPE=local can return user-uploaded SVG or HTML content from the /files/{fileId} retrieval endpoint for direct browser rendering. An attacker with file-upload capability can provide crafted active content and induce another user to open its file URL, causing attacker-controlled JavaScript to execute in the victim's browser. This issue is fixed in…

Original bei NVDAlle Quellen (1)
Hoch 7.5Software

GeoNetwork is a catalog application to manage spatially referenced resources.

CVE-2026-464873. Nov 2026

GeoNetwork is a catalog application to manage spatially referenced resources. From 4.0.0-alpha.1 until 4.2.16 and 4.4.11, the Elasticsearch-backed search proxy can skip GeoNetwork's access-control filter injection when a client request has an omitted query field. The request is then forwarded to Elasticsearch without group visibility, draft exclusion, record ownership, or portal-specific filtering. An unauthenticated remote attacker can use the affected public search API to…

Original bei NVDAlle Quellen (1)
Hoch 7.1Software

GeoNetwork is a catalog application to manage spatially referenced resources.

CVE-2026-393793. Nov 2026

GeoNetwork is a catalog application to manage spatially referenced resources. From 3.0.0 until 4.2.15 and 4.4.10, requesting a nonexistent or unauthorized service URL can cause an error page to reflect attacker-controlled request content inside an AngularJS application without adequately neutralizing it for template evaluation. A remote attacker can induce a victim, including an administrator, to open a crafted link so the reflected value is evaluated as an AngularJS…

Original bei NVDAlle Quellen (1)
Hoch 7.0Software

Monitoring Plugins is a suite of plugins for monitoring applications.

CVE-2026-634183. Nov 2026

Monitoring Plugins is a suite of plugins for monitoring applications. From 3.0.0-rc1 until 3.0.1, check_icmp stores the number of hosts supplied through -H or --Host on the command line, or through --extra-opts files containing Host= entries, in an unsigned short. More than 65,535 hosts wrap the counter, causing process_arguments() to allocate an undersized hosts array and then write subsequent entries out of bounds before main() calls setuid(getuid()). On installations…

Original bei NVDAlle Quellen (1)
Hoch 7.6Software

Nanosystems Supremo for Windows and macOS before 5.0.2.3874 contains an improper certificate validation vulnerability that allows adjacent attackers to…

CVE-2026-1216243. Nov 2026

Nanosystems Supremo for Windows and macOS before 5.0.2.3874 contains an improper certificate validation vulnerability that allows adjacent attackers to intercept TLS connections by presenting untrusted certificates. Attackers on the same network can terminate and relay the client's TLS session using self-signed certificates to read usernames, SHA-256 password hashes, and license codes.

Original bei NVDAlle Quellen (1)
Hoch 7.4Linux-Server

elo: Elo: arbitrary code execution via unvalidated programmatic AST input

CVE-2026-44265elo3. Nov 2026

Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, Elo's programmatic AST API accepts arbitrary values from JSON-deserialized input, plugin output, or other untyped sources and interpolates them into generated JavaScript, Ruby, Python, or SQL without runtime syntax validation. The affected fields are int_literal / float_literal .value, variable.name, member_access.property, object_literal keys, datapath segments, lambda.params[].name, and the…

Original bei Red HatAlle Quellen (2)