net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

Important: Red Hat Security Advisory: yggdrasil-worker-package-manager security update

An update for yggdrasil-worker-package-manager is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severit...

CVE-2026-96892

A flaw has been found in Edimax BR-6428nC 1.16. The impacted element is the function websRedirect of the component goform Handler. Executing a manipulation of the argument submit-url can lead to open redirect. The attack may be launched remotely. The exploit has been published and may be used...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

CVE-2026-96892 Edimax BR-6428nC goform websRedirect redirect

A flaw has been found in Edimax BR-6428nC 1.16. The impacted element is the function websRedirect of the component goform Handler. Executing a manipulation of the argument submit-url can lead to open redirect. The attack may be launched remotely. The exploit has been published and may be used...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

PT-2026-97852

Name of the Vulnerable Software and Affected Versions OpenStack Zaqar versions prior to 22.0.2 Description WSGI transport mishandles the URL-Signature header. An unauthenticated remote attacker who knows a target project's UUID can bypass Keystone authentication and pre-signed URL verification by...

Linux Distros Unpatched Vulnerability : CVE-2026-97404

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. By sending a request with an empty URL-Signature header, an unauthenticate...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git-lfs (UTSA-2026-124463)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-124463 advisory. The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the...

RockyLinux 9 : skopeo (RLSA-2026:70641)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:70641 advisory. skopeo: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56858 skopeo: Go encoding/asn1: Denial of Service via excessive recursion...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git-lfs (UTSA-2026-124474)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-124474 advisory. The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to ...

RHEL 7 : host-metering (RHSA-2026:71619)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:71619 advisory. Host metering service Security Fixes: net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56860...

RHEL 9 : skopeo (RHSA-2026:70641)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:70641 advisory. Command line utility to inspect images and repositories directly on Docker registries without the need to pull them. Security Fixes: skopeo...

RHEL 9 : buildah (RHSA-2026:70640)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:70640 advisory. The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a...

AlmaLinux 9 : skopeo (ALSA-2026:70641)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:70641 advisory. skopeo: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56858 skopeo: Go encoding/asn1: Denial of Service via excessive recursion ...

MiracleLinux 9 : runc-1.4.2-3.el9_8 (AXSA:2026-1907:04)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1907:04 advisory. net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56860 Tenable has extracted the preceding descriptio...

PT-2026-97697

Name of the Vulnerable Software and Affected Versions Edimax BR-6428nC version 1.16 Description A flaw exists in the websRedirect function of the goform Handler component. A remote attacker can manipulate the submit-url argument to cause an open redirect, which occurs when an application redirect...

PT-2026-98224

Name of the Vulnerable Software and Affected Versions TREK versions prior to 3.3.0 Description When the LLM PARSING feature is enabled, an authenticated user with write permission to a trip instance can store an attacker-controlled llm base url via the settings API. This value is processed by the...

PT-2026-98241

Name of the Vulnerable Software and Affected Versions EmbedVideo Extension versions prior to 4.1.0 Description When the $wgEmbedVideoRequireConsent variable is disabled, video URLs are passed into an iframe src attribute without proper sanitization. This allows an attacker to use a malformed URL ...

CVE-2026-96748: Improper Handling of URL Encoding (Hex Encoding)

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of the...