CVE-2026-24895

FrankenPHP is a modern application server for PHP. Prior to 1.11.2, FrankenPHP’s CGI path splitting logic improperly handles Unicode characters during case conversion. The logic computes the split index for finding .php on a lowercased copy of the request path but applies that byte index to the...

OESA-2026-1382 exim security update

Exim is a message transfer agent MTA developed at the University of Cambridge for use on Unix systems connected to the Internet. It is freely available under the terms of the GNU General Public Licence. In style it is similar to Smail 3, but its facilities are more general. There is a great deal ...

CVE-2025-70314

webfsd 1.21 is vulnerable to a Buffer Overflow via a crafted request. This is due to the filename variable...

CVE-2025-70314

webfsd 1.21 is vulnerable to a Buffer Overflow via a crafted request. This is due to the filename variable...

CVE-2026-24895 FrankenPHP affected by Path Confusion via Unicode casing in CGI path splitting allows execution of arbitrary files

FrankenPHP is a modern application server for PHP. Prior to 1.11.2, FrankenPHP’s CGI path splitting logic improperly handles Unicode characters during case conversion. The logic computes the split index for finding .php on a lowercased copy of the request path but applies that byte index to the...

Incorrect Behavior Order: Validate Before Canonicalize

Overview Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize via the splitPos function. An attacker can cause unintended script execution by crafting a request path containing specific multi-byte Unicode characters, which manipulates the...

CVE-2025-70314

webfsd version 1.21 is vulnerable to a Buffer Overflow triggered by a crafted request. The root cause is linked to the handling of the filename variable during buffer copying without sufficient size checking. This vulnerability could potentially lead to a denial-of-service (DoS) attack. While spe...

CVE-2025-70314

webfsd 1.21 is vulnerable to a Buffer Overflow via a crafted request. This is due to the filename variable...

CVE-2025-70314

webfsd 1.21 is vulnerable to a Buffer Overflow via a crafted request. This is due to the filename variable...

Webfsd security vulnerabilities

Webfsd is a simple HTTP server developed by Farshid Ashouri. Version 1.21 of Webfsd contains a security vulnerability, which stems from a buffer overflow in the filename variable. This vulnerability could potentially trigger a denial-of-service attack through specially crafted requests...

CVE-2025-70314: Buffer Copy without Checking Size of Input

webfsd 1.21 is vulnerable to a Buffer Overflow via a crafted request. This is due to the filename variable...

CVE-2025-70314

webfsd 1.21 is vulnerable to a Buffer Overflow via a crafted request. This is due to the filename variable...

CVE-2025-70314

webfsd 1.21 is vulnerable to a Buffer Overflow via a crafted request. This is due to the filename variable...

PT-2026-7891

webfsd 1.21 is vulnerable to a Buffer Overflow via a crafted request. This is due to the filename variable...

PT-2026-7946

Name of the Vulnerable Software and Affected Versions Deciso OPNsense affected versions not specified Description A flaw exists in the handling of backup configuration files within Deciso OPNsense. The issue stems from insufficient validation of user-provided input before it is used in a system...

CVE-2025-70314

webfsd 1.21 is vulnerable to a Buffer Overflow via a crafted request. This is due to the filename variable...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : gpg2 (SUSE-SU-2026:0434-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:0434-1 advisory. Security fixes: - CVE-2026-24882: Fixed stack-based buffer overflow in TPM2 PKDECRYPT for TPM-backed RSA...

CVE-2020-37104

ASTPP 4.0.1 contains an information disclosure vulnerability that allows unauthenticated attackers to download database backup files by predicting backup filename patterns. Attackers can generate a list of 6-digit PIN combinations and fuzz the backup download URL to exfiltrate sensitive database...

CVE-2020-37104

ASTPP 4.0.1 contains an information disclosure vulnerability that allows unauthenticated attackers to download database backup files by predicting backup filename patterns. Attackers can generate a list of 6-digit PIN combinations and fuzz the backup download URL to exfiltrate sensitive database...

CVE-2020-37104 ASTPP 4.0.1 VoIP Billing - Database Backup Download

ASTPP 4.0.1 contains an information disclosure vulnerability that allows unauthenticated attackers to download database backup files by predicting backup filename patterns. Attackers can generate a list of 6-digit PIN combinations and fuzz the backup download URL to exfiltrate sensitive database...