Search vulnerabilities

Expected end of text, found ':' (at char 29), (line:1, col:30)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,865

CVE-2026-66082

Apache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow）

An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to perform unauthorized operations on workflow schedules, workflow definitions, and task instances in other projects. The affected endpoints check permissions against the supplied projectCode but fail to verify that the target resource belongs to that project. An authenticated user with the required permissions in one project can supply that project's code together with a resource identifier from another project, bypassing the target project's access restrictions. The affected endpoints include: * POST /projects/{projectCode}/schedules/{id}/online and /offline: Activate or deactivate workflow schedules in another project. * POST /projects/{projectCode}/workflow-definition/{code}/release: Change the ONLINE/OFFLINE state of workflow definitions in another project. Successful exploitation allows users to alter workflow availability and interfere with task execution in projects they are not authorized to access. This issue affects Apache DolphinScheduler: before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Dolphinscheduler
CVE-2023-51764

postfix: SMTP smuggling vulnerability

Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports <LF>.<CR><LF> but some other popular e-mail servers do not. To prevent attack variants (by always disallowing <LF> without <CR>), a different solution is required, such as the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13, 3.7.9, 3.8.4, or 3.9.

CVSS 3.1 · 5.3 Medium EPSS 2.6% KEV · Not listed
Vendors
Fedoraproject Postfix Redhat
Products
Fedora Postfix Enterprise Linux
CVE-2022-36227

libarchive: NULL pointer dereference in archive_write.c

In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. NOTE: the discoverer cites this CWE-476 remark but third parties dispute the code-execution impact: "In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution."

CVSS 3.1 · 9.8 Critical EPSS 2.5% KEV · Not listed
Vendors
Debian Fedoraproject Libarchive and 2 more
Products
Debian Linux Fedora Libarchive and 3 more
CVE-2022-33070

protobuf-c: invalid arithmetic shift via the function parse_tag_and_wiretype may lead to DoS

Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors.

CVSS 3.1 · 5.5 Medium EPSS 1.1% KEV · Not listed
Vendors
Fedoraproject Protobuf-c Project
Products
Fedora Protobuf-c
CVE-2022-2522

Heap-based Buffer Overflow in vim/vim

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0061.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Vim
Products
Vim
CVE-2022-2344

Heap-based Buffer Overflow in vim/vim

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0045.

CVSS 3.1 · 7.8 High EPSS 1.3% KEV · Not listed
Vendors
Fedoraproject Vim
Products
Fedora Vim
CVE-2022-2343

Heap-based Buffer Overflow in vim/vim

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0044.

CVSS 3.1 · 7.8 High EPSS 1.4% KEV · Not listed
Vendors
Fedoraproject Vim
Products
Fedora Vim
CVE-2022-2284

Heap-based Buffer Overflow in vim/vim

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.

CVSS 3.1 · 7.8 High EPSS 1.4% KEV · Not listed
Vendors
Fedoraproject Vim
Products
Fedora Vim
CVE-2022-2208

NULL Pointer Dereference in vim/vim

NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.5163.

CVSS 3.1 · 5.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Fedoraproject Vim
Products
Fedora Vim
CVE-2022-2207

Heap-based Buffer Overflow in vim/vim

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.

CVSS 3.1 · 7.8 High EPSS 1.4% KEV · Not listed
Vendors
Fedoraproject Vim
Products
Fedora Vim
CVE-2022-2182

Heap-based Buffer Overflow in vim/vim

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.

CVSS 3.1 · 7.8 High EPSS 1.5% KEV · Not listed
Vendors
Fedoraproject Vim
Products
Fedora Vim