Base de CVEs

CVE-2026-21551 Alta · 7.5 CWE-20 03/08/2026

In modem, there is a possible improper input validation. This could lead to remote denial of...

In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed

CVE-2026-21550 Alta · 7.5 CWE-20 03/08/2026

In modem, there is a possible improper input validation. This could lead to remote denial of...

In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed

CVE-2026-21549 Alta · 7.5 CWE-20 03/08/2026

In modem, there is a possible improper input validation. This could lead to remote denial of...

In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed

CVE-2026-21548 Alta · 7.5 CWE-20 03/08/2026

Improper Input Validation em Unisoc (Shanghai) Technologies Co., Ltd. T8100/T9100/T8200/T8300

In nr modem, there is a possible improper input validation. This could lead to remote denial of service with System execution privileges needed.

CVE-2026-59650 Crítica · 9.1 CWE-20 02/08/2026

MTI/A0 DH agreement exponentiates unvalidated peer value

In Bouncy Castle for Java before 1.85, MTI/A0 DH agreement exponentiates unvalidated peer value. This issue also affects Bouncy Castle for Java LTS before 2.73.12.

CVE-2025-71399 Alta · 8.6 CWE-20 02/08/2026

Better Auth before 1.4.5 Path Normalization Bypass via rou3

Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3, paths are normalized by removing empty segments, so /path, //path, and ///path resolve to the same route. In Better Auth versions prior to 1.4.5 (which bundles the fixed rou3), this can allow attackers to bypass disabledPaths configuration and path-based rate limits by submitting requests with extra slashes in the URL path. The issue does not apply in deployments where the proxy or platform normalizes URLs by collapsing multiple slashes.

CVE-2026-67326 Alta · 7.8 CWE-20 01/08/2026

GitPython before 3.1.50 Newline Injection via config_writer section

GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged [core] section with hooksPath pointing to attacker-controlled directories, achieving remote code execution when git hooks are triggered.

CVE-2026-67330 Crítica · 9.9 CWE-20 01/08/2026

Bypass de autorização no plugin SCIM do better-auth via colisão de Provider ID

@better-auth/scim (um plugin do better-auth) nas versões a partir de 1.4.0-beta.27 até 1.6.21 e a partir de 1.7.0-beta.0 até 1.7.0-beta.9 contém um bypass de autorização. A emissão de tokens SCIM não rejeitava provider IDs já usados por provedores existentes de SSO, SAML, OIDC, OAuth genérico ou login social, e o mesmo provider ID lógico era usado tanto para a configuração do provedor SCIM quanto para a propriedade das contas. Um usuário autenticado podia emitir um token SCIM cujo provider ID colidia com um namespace de provedor existente, fazendo com que as rotas de usuário SCIM resolvessem linhas de contas que o token nunca provisionou. Isso permitia listar, ler, atualizar (incluindo reescrever campos globais de perfil e e-mail sem verificações de unicidade) e excluir contas globais de usuários e sessões, resultando em tomada de conta e desprovisionamento não autorizado. Corrigido nas versões 1.6.22 e 1.7.0-beta.10 (1.7.0-rc.0).

CVE-2026-67296 Alta · 7.5 CWE-20 01/08/2026

FreeRDP before 3.29.0 Denial of Service via RDPEI PDU

FreeRDP before 3.29.0 contains a denial of service vulnerability in the RDPEI server channel handler that fails to validate maximum PDU body length before stream allocation. A malicious RDP client can send a header-only RDPEI message with a large declared body length to force excessive memory allocation on the server.

CVE-2026-54909 Média · 5.3 CWE-20 31/07/2026

Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute

pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response parsing paths, allowing remote denial of service. This issue is fixed in version 3.1.3.

CVE-2026-53551 Média · 6.9 CWE-20 31/07/2026

free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure

free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the free5GC AUSF (Authentication Server Function) does not validate the supiOrSuci field in UE authentication requests. Null bytes (\x00) and other control characters pass through JSON parsing unchanged and are forwarded to the UDM in an unescaped URL path. This causes Go's net/url.Parse() to fail, returning HTTP 500 "System failure" and leaking internal stack traces. An unauthenticated attacker can trigger this at scale causing denial of service for all subscribers attempting authentication through the affected AUSF. This vulnerability is fixed in 1.4.5.

CVE-2026-53503 Alta · 7.5 CWE-20 31/07/2026

Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:convolution(<matrix>, <columns>, <should_normalize>) filter passes the user-controlled <columns> value to a C extension (thumbor/ext/filters/_convolution.c) where it is used as a divisor (for % and /) without validating columns > 0. When columns=0, the C code triggers undefined behavior; on x86_64 this reliably results in a fatal divide-by-zero trap (SIGFPE) and crashes the Thumbor process, causing a remote denial of service. This issue is fixed in 7.8.0.

CVE-2025-62347 Média · 4.3 CWE-20 31/07/2026

Improper Input Validation em HCL iControl

HCL iControl was affected by Improper Input Validation vulnerability. It is vulnerable to unexpected system behavior and potential security bypasses. This was caused by an implementation flaw in an architectural security tactic that fails to properly validate whether the received input matches the expected type.

CVE-2026-18217 Média · 4.7 CWE-20 31/07/2026

Keycloak-services: keycloak-services: saml http-redirect binding response preserves query string leading to parameter pollution

A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs when Keycloak handles SAML authentication requests using the HTTP-Redirect binding. If a client is configured with a wildcard redirect URL, an attacker can craft a request that includes malicious parameters. When a user authenticates, Keycloak appends its legitimate response to the attacker's parameters. This can cause some service providers to process the attacker's data instead of the real login information, potentially leading to a user being logged into the wrong account.

CVE-2026-18211 Média · 5.4 CWE-20 31/07/2026

Keycloak-services: keycloak-services: secure-client-uris policy bypass via localhost-prefixed domains

A flaw was found in the secure-client-uris client policy executor within Keycloak core services. This component is responsible for enforcing security requirements on client configurations, such as requiring encrypted connections for redirect URIs. Due to an improper check that only looks at the start of a web address rather than properly verifying the host, an attacker can bypass these security restrictions by using a specially crafted domain name. This could allow an attacker to intercept sensitive authentication codes over unencrypted connections.

CVE-2026-18206 Baixa · 3.7 CWE-20 31/07/2026

Keycloak-services: keycloak-services: client policy source-host wildcard domain matching bypass

A flaw was found in the keycloak-services component of Keycloak, which provides identity and access management services. The issue occurs when a realm administrator uses a wildcard domain (like *.example.com) to restrict which hosts can register or update clients. Due to improper validation, the system accepts any hostname that ends with the specified domain suffix, even if it is not a legitimate subdomain. An attacker who can control the reverse DNS of their connection can bypass these host-based restrictions, potentially allowing unauthorized client modifications.

CVE-2026-65834 Média · 6.8 CWE-20 30/07/2026

Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests

Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec.NodeMetadata.ForbiddenAnnotations.Regex were not validated by the configuration admission webhook, allowing a Cluster Admin to store a malformed regex that later reached regexp.MustCompile in pkg/api/forbidden_list.go through internal/webhook/node/user_metadata.go and crashed the node admission webhook on Node create, update, or patch requests. This issue is fixed in version 0.13.8.

CVE-2026-59881 Média · 6.9 CWE-20 30/07/2026

AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory consumption. This issue is fixed in version 3.14.2.

CVE-2026-18014 Média · 6.5 CWE-20 29/07/2026

Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72...

Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a malicious file. (Chromium security severity: Low)

CVE-2026-18009 Média · 4.3 CWE-20 29/07/2026

Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72...

Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via malicious network traffic. (Chromium security severity: Low)

CVE-2026-18002 Crítica · 9.6 CWE-20 29/07/2026

Insufficient validation of untrusted input in Google Lens in Google Chrome prior to 151.0.7922.72...

Insufficient validation of untrusted input in Google Lens in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-17991 Crítica · 9.6 CWE-20 29/07/2026

Insufficient validation of untrusted input in AI in Google Chrome prior to 151.0.7922.72 allowed...

Insufficient validation of untrusted input in AI in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-17990 Crítica · 9.6 CWE-20 29/07/2026

Insufficient validation of untrusted input in WebAuthn in Google Chrome prior to 151.0.7922.72...

Insufficient validation of untrusted input in WebAuthn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted PDF file. (Chromium security severity: Low)

CVE-2026-17988 Média · 6.5 CWE-20 29/07/2026

Insufficient validation of untrusted input in Navigation in Google Chrome prior to 151.0.7922.72...

Insufficient validation of untrusted input in Navigation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-17987 Crítica · 9.6 CWE-20 29/07/2026

Improper Input Validation em Google Chrome

Insufficient validation of untrusted input in Notifications in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted PDF file. (Chromium security severity: Low)