30988 matches found
CVE-2026-72888
Net::OAuth versions before 0.32 for Perl allow memory exhaustion via unbounded caching of failed module loads in smartrequire. smartrequire stores results in a process-global hash with no bound and no eviction, and keeps an entry for every class name it is asked about, including names that failed...
CVE-2026-74796
OpenTofu before 1.11.7 is affected by a symlink following path traversal during initialization. The vulnerability arises because OpenTofu fails to validate existing symlinks in the provider cache directory, allowing an attacker to place a malicious symlink in a trusted working directory and cause...
CVE-2026-74796 OpenTofu before 1.11.7 Symlink Following Path Traversal
OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package contents to arbitrary filesystem locations outside the working tree...
EUVD-2026-59961
OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package contents to arbitrary filesystem locations outside the working tree...
CVE-2026-74796 OpenTofu before 1.11.7 Symlink Following Path Traversal
OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package contents to arbitrary filesystem locations outside the working tree...
CVE-2026-74791 Scriban before 7.0.0 Authorization Bypass via Stale Include Cache
Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset is called, allowing cached templates to persist across reused contexts. Attackers can exploit request-dependent ITemplateLoader implementations to access previously authorized template content from earli...
EUVD-2026-59957
Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset is called, allowing cached templates to persist across reused contexts. Attackers can exploit request-dependent ITemplateLoader implementations to access previously authorized template content from earli...
CVE-2026-74791 Scriban before 7.0.0 Authorization Bypass via Stale Include Cache
Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset is called, allowing cached templates to persist across reused contexts. Attackers can exploit request-dependent ITemplateLoader implementations to access previously authorized template content from earli...
CVE-2026-74791
Scriban before 7.0.0 contains an Authorization Bypass via Stale Include Cache. The issue is that, when TemplateContext.Reset() is called, the CachedTemplates dictionary is not cleared, allowing cached templates to persist across reused contexts. Attackers could leverage request-dependent ITemplat...
CVE-2026-74791 Scriban before 7.0.0 Authorization Bypass via Stale Include Cache
Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset is called, allowing cached templates to persist across reused contexts. Attackers can exploit request-dependent ITemplateLoader implementations to access previously authorized template content from earli...
CVE-2026-74790
Scriban before 7.0.0 caches TypedObjectAccessor by Type without considering MemberFilter changes, enabling reuse of a TemplateContext to expose members that should be hidden. Affected software: Scriban prior to 7.0.0. Root cause: TemplateContext cache ignores updates to MemberFilter, causing prev...
CVE-2026-74790 Scriban before 7.0.0 MemberFilter Bypass via TemplateContext Cache
Scriban before 7.0.0 caches TypedObjectAccessor by Type only without considering MemberFilter changes, allowing reused TemplateContext instances to expose members that should be hidden. Attackers can access filtered properties and fields by reusing a TemplateContext after tightening its...
CVE-2026-74790 Scriban before 7.0.0 MemberFilter Bypass via TemplateContext Cache
Scriban before 7.0.0 caches TypedObjectAccessor by Type only without considering MemberFilter changes, allowing reused TemplateContext instances to expose members that should be hidden. Attackers can access filtered properties and fields by reusing a TemplateContext after tightening its...
CVE-2026-74790 Scriban before 7.0.0 MemberFilter Bypass via TemplateContext Cache
Scriban before 7.0.0 caches TypedObjectAccessor by Type only without considering MemberFilter changes, allowing reused TemplateContext instances to expose members that should be hidden. Attackers can access filtered properties and fields by reusing a TemplateContext after tightening its...
CVE-2026-74796: Improper Link Resolution Before File Access
OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package contents to arbitrary filesystem locations outside the working tree...
Linux Distros Unpatched Vulnerability : CVE-2026-72888
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Net::OAuth versions before 0.32 for Perl allow memory exhaustion via unbounded caching of failed module loads in smartrequire. smartrequire stores results in a...
SUSE CVE-2026-74463
In the Linux kernel, the following vulnerability has been resolved: i2c: jz4780: Cache host clock rate at probe to prevent CCF preparelock deadlock Fix a severe AB/BA deadlock between the Common Clock Framework CCF and the I2C adapter lock, which triggers when an I2C-controlled clock generator...
SUSE CVE-2026-74487
In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: restore write access when removing an entry Registering an entry with the MISCFMTOPENFILE flag opens the interpreter via openexec which denies write access to it for as long as the entry exists. Removing the entry...
SUSE CVE-2026-74551
In the Linux kernel, the following vulnerability has been resolved: hwmon: nzxt-smart2 DMA-align output buffer Sashiko reports: When sendoutputreport calls hidhwoutputreport, the underlying USB HID core calls usbinterruptmsg which maps this buffer directly for DMA. When the DMA mapping flushes or...
Allocation of Resources Without Limits or Throttling
Overview org.apache.struts:struts2-core is a popular open-source framework for developing web applications in the Java programming language. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the handling of the localized-text cache. An...