262276 matches found
Updated postfix packages fix security vulnerability
Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced status code that lacks text after the third number. CVE-2026-43964...
CVE-2026-53469
creationtimestamp| type| source ---|---|--- 2026-06-10 16:28:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnx4xxgkqi2p 2026-06-14 23:16:43+00:00| seen| https://bsky.app/profile/securitycyberuk.bsky.social/post/3mobvnldold2m 2026-06-15 16:31:49+00:00| seen|...
axios: Axios: HTTP Transport Hijacking via Prototype Pollution
A flaw was found in Axios, an HTTP client library. This vulnerability allows an attacker to exploit a prototype pollution issue if another part of the application has already polluted the Object.prototype. By doing so, the attacker can intercept and modify JSON responses or take control of the HT...
CVE-2026-52751
creationtimestamp| type| source ---|---|--- 2026-06-10 15:27:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnwzh4kpsh2r 2026-06-11 21:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mo24z3qhlg2i...
CVE-2026-49738
The path allowance check in GeneralUtility::isAllowedAbsPath performed a plain string prefix comparison without requiring a directory separator boundary, causing a path like /var/www/html-other/secret.yaml to be incorrectly accepted as valid when the project root was /var/www/html. Administrator...
CVE-2026-34031
Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. The server did not sufficiently validate user-supplied image URLs, allowing arbitrary external content to be embedded as profile images, which could expose users to...
CVE-2026-53438
creationtimestamp| type| source ---|---|--- 2026-06-10 14:59:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnwxybdq6t2p 2026-06-16 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/jenkins-multiple-vulnerabilities20260617...
CVE-2026-25700
CVE-2026-25700 relates to Apache Answer prior to version 2.0.1, where administrative tokens issued before an admin account was suspended, deleted, or deactivated were not invalidated. This allowed continued access to administrative APIs until those tokens expired. Affected product: Apache Answer ...
CVE-2026-25700 Apache Answer: AdminToken not invalidated after admin deactivation
Improper Restriction of Security Token Assignment vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. Previously issued administrative tokens were not invalidated after an administrator account was suspended, deleted, or deactivated, allowing continued access to...
Exploit for Improper Authentication in Checkpoint Gaia_Os
CVE-2026-50751 Check Point IKEv1 Scanner A multi-threaded vul...
EEF-CVE-2026-48858 ftp client PASV response IP not validated against control peer, enabling SSRF and FTP bounce attacks
Summary Server-Side Request Forgery SSRF vulnerability in Erlang/OTP ftp ftp\internal module allows FTP bounce attacks and SSRF via an unvalidated PASV response IP address. The ftp\internal:handle\ctrl\result/2 PASV handler mode=passive, ipfamily=inet, ftp\extension=false extracts the IP address...
CVE-2026-48859 SSH server timing side-channel in ssh_auth:check_password/3 allows unauthenticated username enumeration
Observable Timing Discrepancy vulnerability in Erlang/OTP ssh sshauth, sshoptions modules allows unauthenticated remote username enumeration via timing side-channel in password authentication. When the SSH daemon is configured with the userpasswords or password option, sshauth:checkpassword/3...
CVE-2026-53440
Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet container" security realm is safe to redirect to after login, allowing attackers to perform phishing attacks by redirecting users to an attacker-controlled domain...
CVE-2026-42504 affecting package golang for versions less than 1.26.4-1
CVE-2026-42504 affecting package golang for versions less than 1.26.4-1. A patched version of the package is available...
CVE-2026-49975 affecting package httpd for versions less than 2.4.68-1
CVE-2026-49975 affecting package httpd for versions less than 2.4.68-1. An upgraded version of the package is available that resolves this issue...
@hulumi/policies bypasses policy packs with a forged Pulumi-URN logical name
Affected: @hulumi/policies 1.4.0 — Fixed in: 1.4.0 — Severity: High — CWE-693 Protection Mechanism Failure Summary Pulumi gives every cloud resource a structured URN that includes the resource's type chain hulumi:baseline:aws:SecureBucket$aws:s3/bucketV2:BucketV2 and the logical name the develope...
SUSE-SU-2026:2348-1 Security update for google-cloud-sap-agent
This update for google-cloud-sap-agent fixes the following issue - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1265764. Changes for google-cloud-sap-agent: - Update to version 3.14 bsc1265991...
CVE-2026-10738
creationtimestamp| type| source ---|---|--- 2026-06-10 13:16:27+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mnwsajzizn2m...