NVD CVEs — 本日公開 (111 件)
CVE-2026-109681 4.7 MEDIUM
The FTP client trusts the server's PASV response IP:port without validation against the control connection target. A rogue FTP server can specify any IP:port in the 227 Passive Mode response, causing the operator's machine to open a TCP connection to an arbitrary host.
CVE-2026-109682 4.7 MEDIUM
Metasploit Framework versions before 6.5.7 allow HTTP requests made through send_request_cgi! to follow redirects to a different host without restricting the redirect destination. A malicious HTTP server can cause the system running Metasploit to make requests to arbitrary HTTP services reachable fr
CVE-2026-113706 3.5 LOW
A vulnerability was identified in a2aproject a2a-rs up to 0.4.3. Impacted is an unknown function of the file a2a-server/src/task_store/inmemory.rs. The manipulation of the argument historyLength leads to information disclosure. The attack is possible to be carried out remotely. The identifier of the
CVE-2026-113707 5.4 MEDIUM
A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/task_store/inmemory.rs. The manipulation results in race condition. The attack may be performed from remote. The patch is identified as 7050
CVE-2026-113735 3.7 LOW
A vulnerability was determined in D-Link DCS-6501LH 3.03.02. Affected by this vulnerability is the function mydlink_set_root_pwd of the file /mnt/mtd/aoni_ipc. Executing a manipulation can lead to use of weak credentials. The attack may be launched remotely. The attack requires a high level of compl
CVE-2020-37286 6.5 MEDIUM
Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear inside tuples or nested calls. Contracts using such calls as tuple elements, call arguments, or builtin arguments like concat or ecrecover can retur
CVE-2020-37287 5.9 MEDIUM
Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex types with non-base members are passed as arguments. Contracts passing multi-dimensional arrays or structs to internal or external functions receive corrupted values because the comp
CVE-2020-37288 3.7 LOW
Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing an invalid jump destination (stack underflow). Affected contracts revert such calls unnecessarily, which in limited circumstanc
CVE-2020-37289 3.7 LOW
Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such as ERC20.decimals(), to be stored in uint256 variables without bounds checking. Malicious contracts can return values greater than 255 to manipulate or bypass contract logic that relies on these values.
CVE-2021-48018 7.4 HIGH
Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locations as contract storage variables. When a function using @nonreentrant is called, setting the lock overwrites the overlapping storage variable, corrupting contract state and breaking the cont
GitHub Security Advisories — 本日公開 (20 件)
GHSA-xwr8-qcf8-4867
LOW
A weakness has been identified in Tenstorrent tt-metal up to 0.80.0. The affected element is the...
GHSA-pq4f-mjh8-pjp9
HIGH
The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in...
GHSA-5w5f-rphr-2j3g
CRITICAL
A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the...
GHSA-vmfm-6f34-53x7
HIGH
Deserialization of untrusted data in Mandiant FLARE capa releases before 10.0.0 allows arbitrary...
GHSA-hmqc-m6cv-3c9r
CRITICAL
Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server...
GHSA-p4mc-qjvf-mf2m
MEDIUM
Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from_blueprint by...
GHSA-99jr-jxwf-6chm
HIGH
Deserialization of untrusted data in Mandiant FLARE floss releases before 3.2.0 allows arbitrary...
GHSA-fccw-crcx-53fr
MEDIUM
Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parse_IfExp that...
GHSA-2gvm-cwr3-3pcg
MEDIUM
Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str...
GHSA-vchg-h45q-h36m
MEDIUM
Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line...