Security Check

security.bloxprod.io

Schwachstellen, die jetzt zählen.

CVE für Linux-Server, Android, Apple-Telefone, Windows, Browser, Krypto-Wallets und übrige Software. Ein Klick auf den Titel öffnet das Original beim Herausgeber.

12330Artikel
1687Kritisch
6392Hoch
1781Aktiv ausgenutzt
Alle StufenKritischHochMittelNiedrigAktiv ausgenutzt
Hoch 7.2Software

HumHub Community Edition 1.19.0 contains a stored cross-site scripting vulnerability in the friendship confirmation dialog.

CVE-2026-1155413. Nov 2026

HumHub Community Edition 1.19.0 contains a stored cross-site scripting vulnerability in the friendship confirmation dialog. An authenticated low-privileged member can save HTML in their first and last name. When another authenticated user clicks Friends for that profile, HumHub places the decoded display name into a modal through jQuery html(), causing attacker-controlled markup to execute in the victim's HumHub origin.

Original bei NVDAlle Quellen (1)
Kritisch 9.8Software

Etrel INCH AC charging station management web interface prior to firmware versions 7.1.2 and 8.0.1 contains a hard-coded default credentials vulnerability that…

CVE-2026-1123543. Nov 2026

Etrel INCH AC charging station management web interface prior to firmware versions 7.1.2 and 8.0.1 contains a hard-coded default credentials vulnerability that allows remote attackers to gain full Administrator access by authenticating with the factory-default account. Attackers can log in over cleartext HTTP to obtain complete charger configuration, OCPP ChargePoint Identity, and CSMS WebSocket connection details, enabling unauthorized administrative control of the charging…

Original bei NVDAlle Quellen (1)
Hoch 7.0Software

TinyUSB through 0.21.0, fixed in commit e85c2b8, contains an out-of-bounds write vulnerability in the MTP device class helper mtp_container_get_string() in…

CVE-2026-614953. Nov 2026

TinyUSB through 0.21.0, fixed in commit e85c2b8, contains an out-of-bounds write vulnerability in the MTP device class helper mtp_container_get_string() in src/class/mtp/mtp.h that allows a malicious USB host to corrupt adjacent memory by supplying a crafted MTP string with an unbounded character count. Attackers can exploit the unchecked memcpy operation copying up to 510 bytes into a fixed-size destination buffer to achieve code execution or cause a denial of service on…

Original bei NVDAlle Quellen (1)
Hoch 7.8Software

Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages.

CVE-2026-1158783. Nov 2026

Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. From 1.14.0 until 1.15.0, loading an attacker-supplied lemmatizer checkpoint can execute arbitrary code because stanza/models/lemma/trainer.py stores pos_dict as gzip-compressed pickle bytes and Trainer.load passes the decompressed stream to unrestricted pickle.loads. The outer torch.load call uses weights_only=True, but the nested bytes are treated as a…

Original bei NVDAlle Quellen (1)
Hoch 8.2Linux-Server

@angular/router: @angular/router: Denial of Service via query parameter memory retention during server-side rendering

CVE-2026-111751@angular/router3. Nov 2026

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 21.2.0 until 21.2.25 and 22.2.1, RouterLink directives rendered during Node.js server-side rendering retain computed UrlTree instances for the lifetime of each request. When queryParamsHandling is set to merge or preserve, either per link or through defaultQueryParamsHandling, every rendered link can retain a copy of attacker-controlled…

Original bei Red HatAlle Quellen (2)
Mittel 6.1Linux-Server

@angular/platform-server: @angular/platform-server: Open redirect via improper URL normalization in server-side rendering

CVE-2026-111754@angular/platform-server3. Nov 2026

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, ServerPlatformLocation in Angular server-side rendering checks for protocol-relative URLs before WHATWG URL normalization. A request path containing a popping dot segment followed by multiple slashes can bypass the raw resolveUrl check and normalize to a pathname beginning with two slashes. When Angular SSR…

Original bei Red HatAlle Quellen (2)
Hoch 8.2Linux-Server

@angular/router: @angular/router: Denial of Service via improper route outlet matching in Server-Side Rendering

CVE-2026-111752@angular/router3. Nov 2026

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, @angular/router in Node.js server-side rendering fails to require auxiliary outlet URL segments to match routes configured for their outlet names. Crafted requests containing multiple unconfigured empty-path outlet groups can repeatedly evaluate the route configuration, construct duplicate…

Original bei Red HatAlle Quellen (2)