244 matches found
pyload - Log Injection
A log injection vulnerability was identified in pyload. This vulnerability allows any unauthenticated actor to inject arbitrary messages into the logs gathered by pyload. id: CVE-2024-21645 info: name: pyload - Log Injection author: isacaya severity: medium description: | A log injection...
Symfony Profiler - Remote Access via Injected Arguments
symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the registerargvargc php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by...
CVE-2026-76472
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The...
CVE-2026-76472
The Cisco Meraki Security Hardening Release October 2026 addresses multiple internally discovered vulnerabilities categorized under CWE-74 (Improper Neutralization of Special Elements). These issues involve vulnerabilities where special elements are not properly neutralized in outputs used by dow...
CVE-2026-76472 Cisco Meraki Security Hardening Release October 2026 - Improper Neutralization of Special Elements Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The...
CVE-2026-76472: Improper Neutralization of Special Elements in Output Used by a Downstream Component
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The...
PT-2026-107610
Name of the Vulnerable Software and Affected Versions Cisco networking software affected versions not specified Description An issue exists involving the improper neutralization of special elements, which falls under the Common Weakness Enumeration CWE Pillar CWE-74. This was identified during an...
CVE-2026-20130
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC, engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release...
CVE-2026-20130
Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) are affected by multiple internally discovered vulnerabilities grouped under CWE-74 (Improper Neutralization of Special Elements), addressed as part of a software hardening release following an internal securi...
CVE-2026-20130 Cisco Identity Services Engine Hardening Release - Improper Neutralization Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC, engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release...
CVE-2026-20130: Improper Neutralization of Special Elements in Output Used by a Downstream Component
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC, engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release...
PT-2026-93953
Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE affected versions not specified Cisco ISE Passive Identity Connector ISE-PIC affected versions not specified Description An issue exists involving the improper neutralization of special elements, which falls...
SUSE CVE-2026-88038
cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissiv...
DEBIAN-CVE-2026-88038
cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissiv...
CVE-2026-88038 cookies vulnerable to Set-Cookie attribute injection via unvalidated domain and path options
cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissiv...
CVE-2026-88038
The cookies Node.js library (used by Koa via ctx.cookies) is vulnerable to Set-Cookie attribute injection (CWE-74) in versions before 0.9.2 . The domain and path options are validated against a permissive RFC 7230 field-content matcher that allows semicolons, while the cookie name and value are c...
CVE-2026-88038: Improper Neutralization of Special Elements in Output Used by a Downstream Component
cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissiv...
Malicious Package
Overview aril-74 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...
