Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to improper verification of x-amz- headers in the request. An attacker can gain unauthorized read access to objects by adding the x-amz-copy-source header to a presigned PUT URL,...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to improper verification of x-amz- headers in the request. An attacker can gain unauthorized read access to objects by adding the x-amz-copy-source header to a presigned PUT URL,...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to improper verification of x-amz- headers in the request. An attacker can gain unauthorized read access to objects by adding the x-amz-copy-source header to a presigned PUT URL,...

Improper Verification of Cryptographic Signature

Overview github.com/minio/minio/cmd is an open source object storage server compatible with Amazon S3 APIs. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to improper verification of x-amz- headers in the request. An attacker can gain...

CVE-2026-97731

MinIO through 7aac2a2 does not verify that every x-amz- header present on a request also appears in the client-supplied X-Amz-SignedHeaders list. extractSignedHeaders in cmd/signature-v4-utils.go iterates only the claimed list and never enumerates the headers that actually arrived, and thus a...

CVE-2026-97731

MinIO through 7aac2a2 does not verify that every x-amz- header present on a request also appears in the client-supplied X-Amz-SignedHeaders list. extractSignedHeaders in cmd/signature-v4-utils.go iterates only the claimed list and never enumerates the headers that actually arrived, and thus a...

CVE-2026-97731

MinIO through 7aac2a2 does not verify that every x-amz- header present on a request also appears in the client-supplied X-Amz-SignedHeaders list. extractSignedHeaders in cmd/signature-v4-utils.go iterates only the claimed list and never enumerates the headers that actually arrived, and thus a...

EUVD-2026-86510

MinIO through 7aac2a2 does not verify that every x-amz- header present on a request also appears in the client-supplied X-Amz-SignedHeaders list. extractSignedHeaders in cmd/signature-v4-utils.go iterates only the claimed list and never enumerates the headers that actually arrived, and thus a...

CVE-2026-97731

MinIO through 7aac2a2 does not verify that every x-amz- header present on a request also appears in the client-supplied X-Amz-SignedHeaders list. extractSignedHeaders in cmd/signature-v4-utils.go iterates only the claimed list and never enumerates the headers that actually arrived, and thus a...

CVE-2026-97731

Versions of MinIO through 7aac2a2 and pgsty/silo before 1233254 are vulnerable to a security flaw where the system fails to verify if all received x-amz-* headers are present in the client-supplied X-Amz-SignedHeaders list. Specifically, the extractSignedHeaders() function in cmd/signature-v4-uti...

The vulnerability of the Erlang/OTP software platform, related to copying buffers without checking the size of the input data, allows a hacker to trigger a service failure.

The vulnerability of the Erlang/OTP software platform lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability could allow a malicious actor to cause service failures...

CVE-2026-97579: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity vdecav1slicesetuptile copies tilecols + 1 / tilerows + 1 entries into micolstarts / mirowstarts from the bitstream tileinfo. Bound the copy to the array...

CVE-2026-97579

In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity vdecav1slicesetuptile copies tilecols + 1 / tilerows + 1 entries into micolstarts / mirowstarts from the bitstream tileinfo. Bound the copy to the array...

CVE-2026-97731: Improper Verification of Cryptographic Signature

MinIO through 7aac2a2 does not verify that every x-amz- header present on a request also appears in the client-supplied X-Amz-SignedHeaders list. extractSignedHeaders in cmd/signature-v4-utils.go iterates only the claimed list and never enumerates the headers that actually arrived, and thus a...

PT-2026-98470

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A CPU soft lockup can occur in the scsi qla2xxx driver due to an incorrect polling mechanism in the qla27xx copy multiple pkt and qla27xx copy fpin pkt functions. These functions poll th...

PT-2026-98499

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer overflow occurs in the SMB client when rewriting a Discretionary Access Control List DACL. The functions replace sids and copy aces and set chmod dacl use a u16 accumulator to...

PT-2026-98519

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mediatek vcodec component where the vdec av1 slice setup tile function copies tile cols + 1 and tile rows + 1 entries from the bitstream tile info into the mi col...

firefox: thunderbird: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component...

Exploit for Write-what-where Condition in Linux Linux_Kernel

CVE-2026-43284-DIRTY-FRAG- Detailed technical analysis of CVE-...

DEBIAN-CVE-2026-97149

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...