HeroDevs

Latest CVEs · RSS

• CVE-2026-68498 2026-10-16 · CVSS 7.5
  StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being
• CVE-2026-68496 2026-10-01 · CVSS 7.5
  The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property names, so t
• CVE-2026-68495 2026-10-01 · CVSS 7.5
  The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property names, so th
• CVE-2026-91777 2026-09-23 · CVSS 7.5
  Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for ever
• CVE-2026-91776 2026-09-23 · CVSS 7.5
  TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-base
• CVE-2026-89425 2026-09-23 · CVSS 7.5
  UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier chara
• CVE-2026-89407 2026-09-22 · CVSS 7.5
  NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\.]?[0
• CVE-2026-68497 2026-09-11 · CVSS 7.5
  jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to Dat
• CVE-2026-83557 2026-09-01 · CVSS 5.6
  DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom va
• CVE-2026-19032 2026-09-01 · CVSS 5.3
  jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPat
• CVE-2026-68494 2026-08-04 · CVSS 8.7
  The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incom
• CVE-2026-18401 2026-08-04 · CVSS 6.9
  The non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 char
• CVE-2026-11998 2026-06-24 · CVSS 7.6
  A flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies for resource URLs and can lead to arbitrary JavaScript executi
• CVE-2026-2818 2026-02-20 · CVSS 8.2
  A zip-slip path traversal vulnerability in Spring Data Geode's import snapshot functionality allows attackers to write files outside the intended extraction dir
• CVE-2026-2817 2026-02-19 · CVSS 4.4
  Use of insecure directory in Spring Data Geode snapshot import extracts archives into predictable, permissive directories under the system temp location. On sha
• CVE-2025-14505 2026-01-08 · CVSS 5.6
  The ECDSA implementation of the Elliptic package generates incorrect signatures if an interim value of 'k' (as computed based on step 3.2 of RFC 6979 https://d
• CVE-2025-8083 2025-12-12 · CVSS 8.6
  The Preset configuration https://v2.vuetifyjs.com/en/features/presets  feature of Vuetify is vulnerable to Prototype Pollution https://cheatsheetseries.owasp.
• CVE-2025-8082 2025-12-12 · CVSS 6.3
  Improper neutralization of the title date in the 'VDatePicker' component in Vuetify, allows unsanitized HTML to be inserted into the page. This can lead to a C
• CVE-2025-36855 2025-09-08 · CVSS 8.8
  A vulnerability ( CVE-2025-21176 https://www.cve.org/CVERecord ) exists in DiaSymReader.dll due to buffer over-read. Per CWE-126: Buffer Over-read https://cw
• CVE-2025-36854 2025-09-08 · CVSS 8.1
  A vulnerability ( CVE-2024-38229 https://www.cve.org/CVERecord ) exists in EOL ASP.NET when closing an HTTP/3 stream while application code is writing to the re
• CVE-2025-36853 2025-09-08 · CVSS 7.5
  A vulnerability (CVE-2025-21172) exists in msdia140.dll due to integer overflow and heap-based overflow. Per CWE-122: Heap-based Buffer Overflow, a heap overf
• CVE-2025-4690 2025-08-19 · CVSS 4.3
  A regular expression used by AngularJS'  linky https://docs.angularjs.org/api/ngSanitize/filter/linky  filter to detect URLs in input text is vulnerable to supe
• CVE-2025-7326 2025-07-08 · CVSS 7.0
  Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. NOTE: This CVE affects only End Of Life (EOL) sof
• CVE-2025-36852 2025-06-10 · CVSS 9.4
  A critical security vulnerability exists in remote cache extensions for common build systems utilizing bucket-based remote cache (such as those using Amazon S3,
• CVE-2025-2336 2025-06-04 · CVSS 4.8
  Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements in AngularJS's 'ngSanitize' module allows attackers to by