https://vulnogram.org/ Most recent CVEs assigned by HeroDevs (herodevs). https://vulnogram.org/seaview/icons/herodevs.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-68498 https://vulnogram.org/CVE-2026-68498 StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength (default 100,000,000 characters)… High Network Exploitable Fri, 16 Oct 2026 21:11:03 GMT https://vulnogram.org/CVE-2026-68496 https://vulnogram.org/CVE-2026-68496 The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. SmileParser._handleLongFieldName()… High Network Exploitable Thu, 01 Oct 2026 17:36:57 GMT https://vulnogram.org/CVE-2026-68495 https://vulnogram.org/CVE-2026-68495 The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. CBORParser._decodeLongerName() deco… High Network Exploitable Thu, 01 Oct 2026 17:36:22 GMT https://vulnogram.org/CVE-2026-91777 https://vulnogram.org/CVE-2026-91777 Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulato… High Network Exploitable Wed, 23 Sep 2026 02:21:48 GMT https://vulnogram.org/CVE-2026-91776 https://vulnogram.org/CVE-2026-91776 TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, def… High Network Exploitable Wed, 23 Sep 2026 02:17:50 GMT https://vulnogram.org/CVE-2026-89425 https://vulnogram.org/CVE-2026-89425 UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parse… High Network Exploitable Wed, 23 Sep 2026 02:06:10 GMT https://vulnogram.org/CVE-2026-89407 https://vulnogram.org/CVE-2026-89407 NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and PATTERN_FLOAT_TRAILING_DOT, added in 2.… High Network Exploitable Tue, 22 Sep 2026 14:53:20 GMT https://vulnogram.org/CVE-2026-68497 https://vulnogram.org/CVE-2026-68497 jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.… High Network Exploitable Fri, 11 Sep 2026 15:49:30 GMT https://vulnogram.org/CVE-2026-83557 https://vulnogram.org/CVE-2026-83557 DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and… Medium Network Exploitable Tue, 01 Sep 2026 14:57:01 GMT https://vulnogram.org/CVE-2026-19032 https://vulnogram.org/CVE-2026-19032 jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and th… Medium Network Exploitable Tue, 01 Sep 2026 03:18:42 GMT https://vulnogram.org/CVE-2026-68494 https://vulnogram.org/CVE-2026-68494 The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLengt… High Network Exploitable Tue, 04 Aug 2026 14:39:14 GMT https://vulnogram.org/CVE-2026-18401 https://vulnogram.org/CVE-2026-18401 The non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters). An attacker able to submit JSON to an application that uses the async parser API… Medium Network Exploitable Tue, 04 Aug 2026 14:23:27 GMT https://vulnogram.org/CVE-2026-11998 https://vulnogram.org/CVE-2026-11998 A flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies for resource URLs and can lead to arbitrary JavaScript execution within the context of the victim's browser session. SCE's purpose is to ensure that onl… High Network Exploitable Unsupported When Assigned Wed, 24 Jun 2026 20:29:37 GMT https://vulnogram.org/CVE-2026-2818 https://vulnogram.org/CVE-2026-2818 A zip-slip path traversal vulnerability in Spring Data Geode's import snapshot functionality allows attackers to write files outside the intended extraction directory. This vulnerability appears to be susceptible on Windows OS only. High Network Exploitable Unsupported When Assigned Fri, 20 Feb 2026 16:03:21 GMT https://vulnogram.org/CVE-2026-2817 https://vulnogram.org/CVE-2026-2817 Use of insecure directory in Spring Data Geode snapshot import extracts archives into predictable, permissive directories under the system temp location. On shared hosts, a local user with basic privileges can access another user’s extracted snapshot… Medium Unsupported When Assigned Thu, 19 Feb 2026 17:18:09 GMT https://vulnogram.org/CVE-2025-14505 https://vulnogram.org/CVE-2025-14505 The ECDSA implementation of the Elliptic package generates incorrect signatures if an interim value of 'k' (as computed based on step 3.2 of RFC 6979 https://datatracker.ietf.org/doc/html/rfc6979 ) has leading zeros and is susceptible to cryptanalysi… Medium Network Exploitable Thu, 08 Jan 2026 21:05:14 GMT https://vulnogram.org/CVE-2025-8083 https://vulnogram.org/CVE-2025-8083 The Preset configuration https://v2.vuetifyjs.com/en/features/presets feature of Vuetify is vulnerable to Prototype Pollution https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html due to the internal 'mergeDee… High Network Exploitable Unsupported When Assigned Fri, 12 Dec 2025 19:29:06 GMT https://vulnogram.org/CVE-2025-8082 https://vulnogram.org/CVE-2025-8082 Improper neutralization of the title date in the 'VDatePicker' component in Vuetify, allows unsanitized HTML to be inserted into the page. This can lead to a Cross-Site Scripting (XSS) https://owasp.org/www-community/attacks/xss attack. The vulnerabi… Medium Network Exploitable Unsupported When Assigned Fri, 12 Dec 2025 18:33:07 GMT https://vulnogram.org/CVE-2025-36855 https://vulnogram.org/CVE-2025-36855 A vulnerability ( CVE-2025-21176 https://www.cve.org/CVERecord ) exists in DiaSymReader.dll due to buffer over-read. Per CWE-126: Buffer Over-read https://cwe.mitre.org/data/definitions/126.html , Buffer Over-read is when a product reads from a buffe… High Network Exploitable Mon, 08 Sep 2025 13:57:28 GMT https://vulnogram.org/CVE-2025-36854 https://vulnogram.org/CVE-2025-36854 A vulnerability ( CVE-2024-38229 https://www.cve.org/CVERecord ) exists in EOL ASP.NET when closing an HTTP/3 stream while application code is writing to the response body, a race condition may lead to use-after-free, resulting in Remote Code Executi… High Network Exploitable Mon, 08 Sep 2025 13:53:08 GMT https://vulnogram.org/CVE-2025-36853 https://vulnogram.org/CVE-2025-36853 A vulnerability (CVE-2025-21172) exists in msdia140.dll due to integer overflow and heap-based overflow. Per CWE-122: Heap-based Buffer Overflow, a heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in… High Network Exploitable Mon, 08 Sep 2025 13:48:43 GMT https://vulnogram.org/CVE-2025-4690 https://vulnogram.org/CVE-2025-4690 A regular expression used by AngularJS' linky https://docs.angularjs.org/api/ngSanitize/filter/linky filter to detect URLs in input text is vulnerable to super-linear runtime due to backtracking. With a large carefully-crafted input, this can cause a… Medium Network Exploitable Unsupported When Assigned Tue, 19 Aug 2025 13:19:27 GMT https://vulnogram.org/CVE-2025-7326 https://vulnogram.org/CVE-2025-7326 Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. NOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor… High Network Exploitable Tue, 08 Jul 2025 14:31:45 GMT https://vulnogram.org/CVE-2025-36852 https://vulnogram.org/CVE-2025-36852 A critical security vulnerability exists in remote cache extensions for common build systems utilizing bucket-based remote cache (such as those using Amazon S3, Google Cloud Storage, or similar object storage) that allows any contributor with pull re… Critical Tue, 10 Jun 2025 19:23:33 GMT https://vulnogram.org/CVE-2025-2336 https://vulnogram.org/CVE-2025-2336 Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements in AngularJS's 'ngSanitize' module allows attackers to bypass common image source restrictions. This can lead to a form of Content Spoofing https:/… Medium Network Exploitable Unsupported When Assigned Wed, 04 Jun 2025 16:32:31 GMT https://vulnogram.org/CVE-2025-1461 https://vulnogram.org/CVE-2025-1461 Improper neutralization of the value of the 'eventMoreText' property of the 'VCalendar' component in Vuetify allows unsanitized HTML to be inserted into the page. This can lead to a Cross-Site Scripting (XSS) https://owasp.org/www-community/attacks/x… Medium Network Exploitable Unsupported When Assigned Wed, 28 May 2025 17:26:51 GMT https://vulnogram.org/CVE-2025-1647 https://vulnogram.org/CVE-2025-1647 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Bootstrap allows Cross-Site Scripting (XSS).This issue affects Bootstrap: from 3.4.1 before 4.0.0. Medium Network Exploitable Thu, 15 May 2025 16:26:07 GMT https://vulnogram.org/CVE-2025-0716 https://vulnogram.org/CVE-2025-0716 Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements in AngularJS allows attackers to bypass common image source restrictions. This can lead to a form of Content Spoofing https://owasp.org/www-communi… Medium Network Exploitable Unsupported When Assigned Tue, 29 Apr 2025 16:26:19 GMT https://vulnogram.org/CVE-2024-10491 https://vulnogram.org/CVE-2024-10491 A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used. The issue arises from improper sanitization in `Link` header values, which can all… Medium Network Exploitable Tue, 29 Oct 2024 16:23:21 GMT https://vulnogram.org/CVE-2024-9506 https://vulnogram.org/CVE-2024-9506 Improper regular expression in Vue's parseHTML function leads to a potential regular expression denial of service vulnerability. Low Network Exploitable Tue, 15 Oct 2024 15:40:04 GMT https://vulnogram.org/CVE-2024-9266 https://vulnogram.org/CVE-2024-9266 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Express. This vulnerability affects the use of the Express Response object. This issue impacts Express: from 3.4.5 before 4.0.0. Medium Network Exploitable Thu, 03 Oct 2024 18:56:38 GMT https://vulnogram.org/CVE-2024-8373 https://vulnogram.org/CVE-2024-8373 Improper sanitization of the value of the [srcset] attribute in <source> HTML elements in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/attacks… Medium Network Exploitable Unsupported When Assigned Mon, 09 Sep 2024 14:48:41 GMT https://vulnogram.org/CVE-2024-8372 https://vulnogram.org/CVE-2024-8372 Improper sanitization of the value of the 'srcset' attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing . This i… Medium Network Exploitable Unsupported When Assigned Mon, 09 Sep 2024 14:46:03 GMT https://vulnogram.org/CVE-2024-6783 https://vulnogram.org/CVE-2024-6783 A vulnerability has been discovered in Vue, that allows an attacker to perform XSS via prototype pollution. The attacker could change the prototype chain of some properties such as `Object.prototype.staticClass` or `Object.prototype.staticStyle` to e… Medium Network Exploitable Tue, 23 Jul 2024 15:05:57 GMT https://vulnogram.org/CVE-2024-6485 https://vulnogram.org/CVE-2024-6485 A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by inje… Medium Network Exploitable Thu, 11 Jul 2024 17:08:08 GMT