32878 matches found
Improper Encoding Or Escaping Of Output
Apache Log4j API is vulnerable to Improper Encoding or Escaping of Output. The vulnerability is due to improper encoding of non-finite floating-point values during MapMessage JSON serialization, which allows an attacker to inject NaN or Infinity values that produce malformed JSON and disrupt...
Important: Red Hat Security Advisory: libtiff security, bug fix, and enhancement update
An update for libtiff is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...
compat-libtiff3 security update
An update is available for compat-libtiff3. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The libtiff3 package provides libtiff 3, an older version of libtiff...
libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image
A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT8BITABGR output format and a specific stride value, leading to a heap-base...
[SECURITY] Fedora 43 Update: goaccess-1.11-1.fc43
GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems. It provides fast and valuable HTTP statistics for system administrators that require a visual server report on the fly. Features: GoAccess parses the specified web log file and outputs the data...
[SECURITY] Fedora 44 Update: goaccess-1.11-1.fc44
GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems. It provides fast and valuable HTTP statistics for system administrators that require a visual server report on the fly. Features: GoAccess parses the specified web log file and outputs the data...
Exploit for Improper Output Neutralization for Logs in Neo4J
CVE-2026-1337 – AI Coding Assistant Prompt Injection to RCE !...
📄 OpenClaw Dashboard 3.0.0 Cross Site Scripting
OpenClaw Dashboard version 3.0.0 suffers from a persistent cross site scripting vulnerability in the Failed Login Username Field. Security Advisory: Unauthenticated Stored Cross-Site Scripting Leading To Administrator Account Takeover openclaw-dashboard Title: OpenClaw Dashboard v3.0.0 Stored XSS...
PT-2026-67488
Name of the Vulnerable Software and Affected Versions ClearOS version 7.9 Description The Log Viewer component contains an OS command injection flaw. Authenticated attackers can execute arbitrary commands by submitting unsanitized input through the filter parameter, which is interpolated directly...
CVE-2026-67599: Improper Neutralization of Special Elements used in an OS Command
ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component that allows authenticated attackers to execute arbitrary commands by submitting unsanitized input through the filter parameter, which is interpolated directly into a shell command in File.php. Attackers can...
OSSEC HIDS 4.2.0
OSSEC is a full platform to monitor and control your systems. It mixes together all the aspects of HIDS host-based intrusion detection, log monitoring and SIM/SIEM together in a simple, powerful and open source solution. This is the source code release...
CVE-2026-14214
creationtimestamp| type| source ---|---|--- 2026-08-01 14:43:21+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrzpdtkybh24 2026-08-01 14:43:51+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mrzpepsjd42u 2026-08-01 15:26:19+00:00| seen|...
CVE-2026-13158
creationtimestamp| type| source ---|---|--- 2026-08-01 14:00:04+00:00| seen| https://t.me/GithubRedTeam/96151 2026-08-01 14:53:39+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mrzpwamqyx2r 2026-08-01 14:53:39+00:00| seen|...
CVE-2026-10773
The DHCPv4 client helper netdhcpv4msgtypename in subsys/net/lib/dhcpv4/dhcpv4.c indexes a static 8-element const char name table after a faulty bounds check. The guard used msgtype = sizeofname instead of msgtype = ARRAYSIZEname; sizeof returns the byte size of the pointer array 32 on 32-bit, 64 ...
CVE-2026-10773 Out-of-bounds read in DHCPv4 client message-type name lookup (net_dhcpv4_msg_type_name)
The DHCPv4 client helper netdhcpv4msgtypename in subsys/net/lib/dhcpv4/dhcpv4.c indexes a static 8-element const char name table after a faulty bounds check. The guard used msgtype = sizeofname instead of msgtype = ARRAYSIZEname; sizeof returns the byte size of the pointer array 32 on 32-bit, 64 ...
CVE-2026-10773
The DHCPv4 client helper netdhcpv4msgtypename in subsys/net/lib/dhcpv4/dhcpv4.c indexes a static 8-element const char name table after a faulty bounds check. The guard used msgtype = sizeofname instead of msgtype = ARRAYSIZEname; sizeof returns the byte size of the pointer array 32 on 32-bit, 64 ...
EUVD-2026-51868
The DHCPv4 client helper netdhcpv4msgtypename in subsys/net/lib/dhcpv4/dhcpv4.c indexes a static 8-element const char name table after a faulty bounds check. The guard used msgtype = sizeofname instead of msgtype = ARRAYSIZEname; sizeof returns the byte size of the pointer array 32 on 32-bit, 64 ...
PT-2026-67003
Name of the Vulnerable Software and Affected Versions affected versions not specified Description The DHCPv4 client helper function net dhcpv4 msg type name in subsys/net/lib/dhcpv4/dhcpv4.c contains a faulty bounds check when indexing a static 8-element name table. The check incorrectly uses...
CVE-2026-55777
A flaw was found in GoAccess. A remote attacker can craft a malicious User-Agent string in an access log. The parseios function, which processes log data, incorrectly uses an attacker-controlled offset. This can lead to an out-of-bounds heap read, causing the application to crash and resulting in...
CVE-2026-65311
The HTTP server component of ANDRITZ HIPASE-250 formerly 250 SCALA in affected versions exposes an undocumented endpoint that changes the server's logging level and target without requiring authentication. A remote, unauthenticated attacker with network access to the service may suppress audit...