28493 matches found
PT-2026-100328
Security vulnerability affects the airflow-2 package. This issue is resolved in later releases. See references for vulnerability details...
CVE-2026-61550: Missing Authorization
Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and...
PT-2026-101826
Security vulnerability affects the airflow-2 package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-101715
Security vulnerability affects the airflow-2 package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-100872
Security vulnerability affects the airflow-2 package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-95421
Name of the Vulnerable Software and Affected Versions Netty affected versions not specified Description A flaw exists where the HTTP-object conversion path incorrectly processes specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests as regular HTTP/1.1 CONNECT requests. This misinterpretati...
PT-2026-101432
Security vulnerability affects the airflow-2 package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-95409
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An out-of-bounds read exists in the gptp mi qualify announce function within subsys/net/l2/ethernet/gptp/gptp mi.c. The issue occurs when processing the Path Tra...
CVE-2026-93579: Undefined Security Weakness
A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary,...
CVE-2026-71418: Inefficient Algorithmic Complexity
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, DNS-over-HTTP/2 processing in rust/src/http2/http2.rs retains previously processed HTTP/2 DATA frame contents instead of clearing the internal buffer...
CVE-2026-93492: Undefined Security Weakness
A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAXHEADERTABLESIZE. This causes the HpackEncoder to store an excessive number of unique headers, leading to increased CPU usage and memory consumption, ultimatel...
PT-2026-95420
Name of the Vulnerable Software and Affected Versions Netty affected versions not specified Description A flaw exists in the HTTP/2 codec when converting HTTP/1 CONNECT requests to HTTP/2. The component incorrectly utilizes the Host header instead of the CONNECT authority-form request-target to...
PT-2026-95422
Name of the Vulnerable Software and Affected Versions Netty affected versions not specified Description An issue exists in the HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request contains both an absolute-form request-target and a conflicting Host header, the system incorrectly prioritize...
CVE-2026-93568: Improper Input Validation
A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical...
PT-2026-95511
Name of the Vulnerable Software and Affected Versions Netty affected versions not specified Description A flaw in the HTTP/2 stack allows a remote attacker to inject prohibited characters, including NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validatio...
CVE-2026-93567: Improper Input Validation
A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leadi...
CVE-2026-61552: Improper Control of Generation of Code
Icinga 2 is an open source monitoring system. From 2.4 until 2.14.9, 2.15.4, and 2.16.2, the /v1/objects API writes attacker-controlled template names into generated configuration without escaping them. An authenticated ApiUser with an objects/create/ permission can inject Icinga 2 DSL...
PT-2026-101285
Security vulnerability affects the airflow-2 package. This issue is resolved in later releases. See references for vulnerability details...