177192 matches found
golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the Root.Chmod function is replaced with a symbolic link during execution, specifically after Root.Chmod checks the target but before acting, the chmod operation will be performed on the file the...
CVE-2026-73489
Russh is a Rust SSH client & server library. Prior to 0.62.4, an authenticated SSH client can cause a denial of service by sending a pty-req channel request with more than 130 terminal-mode records. The parser in russh/src/server/encrypted.rs stores terminal modes in a fixed 130-entry...
CVE-2026-56858
Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...
CVE-2026-56859
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...
CVE-2026-56858
Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...
CVE-2026-56853
When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this...
CVE-2026-56860
Previously, resolving relative paths containing parent directory '..' segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking f...
CVE-2026-56859
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...
CVE-2026-73480
gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other...
CVE-2026-73429 vulnerabilities
Vulnerabilities for packages: yazi...
CVE-2026-73430 vulnerabilities
Vulnerabilities for packages: yazi...
CVE-2026-73491 vulnerabilities
Vulnerabilities for packages: ruby4.0-rails, ruby3.4-rails, ruby3.2-rails...
CVE-2026-73420 vulnerabilities
Vulnerabilities for packages: langfuse, jitsucom-jitsu...
CVE-2026-73418 vulnerabilities
Vulnerabilities for packages: langfuse, jitsucom-jitsu...
CVE-2026-73419 vulnerabilities
Vulnerabilities for packages: langfuse, jitsucom-jitsu...
CVE-2026-73502 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-elasticache, crossplane-provider-aws-kinesis, crossplane-provider-azure-storage, crossplane-provider-aws-iam, hugo-extended, dataplaneapi, crossplane-provider-aws-s3, terraform-provider-grafana, crossplane-provider-aws-kms,...
CVE-2026-54399 vulnerabilities
Vulnerabilities for packages: sonarqube, druid, kserve-modelmesh, opensearch, thingsboard, apicurio-registry, logstash, cassandra-reaper, nrjmx, akhq...
CVE-2026-73429 vulnerabilities
Vulnerabilities for packages: yazi...