5161706 matches found
CVE-2026-77643
A cross-site scripting vulnerability in queryparser/termgeneratorinternal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet. NOTE: this issue exists because of a missed corner case of CVE-2018-0499...
USN-8656-1: Linux kernel (HWE) vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - x86 architecture; - InfiniBand drivers; - Network drivers; - Mellanox network drivers; - File systems infrastructur...
Important: Red Hat Security Advisory: dracut security update
An update for dracut is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
dracut: dracut: Root code execution via DHCP options command injection
A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP Dynamic Host Configuration Protocol options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and...
dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()
A flaw was found in dracut. The die error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOTPATH option, an attacker on the adjacent network who controls...
CVE-2026-77639
Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022...
CVE-2026-77638
Tor before 0.4.9.11 is prone to a race condition where in just the right circumstances a rendezvous point could man-in-the-middle impersonate the onion service that the client was trying to reach...
CVE-2026-77641
tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUXSWITCH cell fails. The return value of relaysendcommandfromedge was ignored, so a send failure which calls circuitmarkforclose and removes the leg via cfxdelleg would go undetected, causing the caller to write to the...
CVE-2026-77640
tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches ZSTREAMEND, causing zlib to return ZBUFERROR with no input remaining, which bufaddcompress mistook for a full output buffer and retried forever. Fixed by...
CVE-2026-76021
Use after free in DOM in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-77587
Tor before 0.4.9.11 is prone to a use-after-free and potential double free of a conflux object when a recovery leg revives a conflux set whose last linked leg has already been closed. A malicious exit node could use this to crash a client. This is TROVE-2026-026...
CVE-2026-77584
Tor before 0.4.9.10 did not reject a CONFLUXLINK cell that arrives on a circuit which already has attached streams. A malicious client could send a RELAYCOMMANDBEGIN before the CONFLUXLINK on the same circuit, attaching an exit stream that would later end up orphan leaving a dangling circuit...
CVE-2026-76023
Improper resource control in Linux Toolkit Theming in Google Chrome prior to 151.0.7922.173 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-76019
Incorrect authorization in Workers in Google Chrome prior to 151.0.7922.173 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: High...
CVE-2026-76022
Buffer overflow in Network in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-77506
Znuny before LTS 6.5.22 allows AgentTicketEmailResend template XSS...
CVE-2026-76020
Race condition in V8 in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-73040
Dockge validates a stack name only on the write path. In backend/stack.ts the allow-list check in validate, which requires the name to match ^a-z0-9-+$, is reached from save alone, while the path getter returns path.jointhis.server.stacksDir, this.name and Stack.getStack builds...
CVE-2026-74836
Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin an unbounded number of HTTP/2 stream processes indefinitely via connection-level flow control. When a stream's response body outruns the HTTP/2 connection-level se...