39694 matches found
Netty's Default QUIC token handler accepts any client-supplied token
NoQuicTokenHandler is the tokenHandler used when the application does not set one. Its writeToken returns false server will not send Retry — acceptable, but validateToken unconditionally return 0. In QuicheQuicServerCodec.handlePacket, a non-negative return from validateToken is interpreted as...
GHSA-CMM3-54F8-PX4J Netty's Default QUIC token handler accepts any client-supplied token
NoQuicTokenHandler is the tokenHandler used when the application does not set one. Its writeToken returns false server will not send Retry — acceptable, but validateToken unconditionally return 0. In QuicheQuicServerCodec.handlePacket, a non-negative return from validateToken is interpreted as...
CVE-2026-29170
creationtimestamp| type| source ---|---|--- 2026-06-08 21:33:38+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mnsmy6kpfq2g 2026-06-09 12:35:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mnu7hq6yhy25 2026-06-09 18:00:00+00:00| seen|...
CVE-2026-11556
A security flaw has been discovered in Tenda F451 1.0.0.7/1.0.0.9. Impacted is the function formWriteFacMac of the file /goform/WriteFacMac of the component Web Management Interface. Performing a manipulation of the argument mac results in os command injection. Remote exploitation of the attack i...
gpac:fuzz_scene: Segv on unknown address in gf_node_register
Project: https://github.com/gpac/gpac.git Detailed Report: https://oss-fuzz.com/testcase?key=5942827464065024 Project: gpac Fuzzing Engine: afl Fuzz Target: fuzzscene Job Type: aflasangpac Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: gfnoderegister...
gpac:fuzz_scene: Heap-use-after-free in ReplaceDEFNode
Project: https://github.com/gpac/gpac.git Detailed Report: https://oss-fuzz.com/testcase?key=5905734247448576 Project: gpac Fuzzing Engine: libFuzzer Fuzz Target: fuzzscene Job Type: libfuzzerasangpac Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x7576b4be0040 Crash...
CVE-2026-11534
A vulnerability was detected in imvks786 studentmanagementsystem up to 9599b560ad3c3b83e75d328b76bedcd489ef1f46. Affected by this issue is some unknown functionality of the file /add.php. The manipulation of the argument name/address/fname results in cross site scripting. It is possible to launch...
CVE-2026-11534 imvks786 student_management_system add.php cross site scripting
A vulnerability was detected in imvks786 studentmanagementsystem up to 9599b560ad3c3b83e75d328b76bedcd489ef1f46. Affected by this issue is some unknown functionality of the file /add.php. The manipulation of the argument name/address/fname results in cross site scripting. It is possible to launch...
lucene:QueryParserFuzzer: Security exception in org.apache.lucene.util.ArrayUtil.copyOfSubArray
Detailed Report: https://oss-fuzz.com/testcase?key=5138574369685504 Project: lucene Fuzzing Engine: libFuzzer Fuzz Target: QueryParserFuzzer Job Type: libfuzzerasanlucene Platform Id: linux Crash Type: Security exception Crash Address: Crash State: org.apache.lucene.util.ArrayUtil.copyOfSubArray...
USN-8406-1 libnet-cidr-lite-perl vulnerabilities
Dave Rolsky discovered that Net::CIDR::Lite did not properly handle extraneous zero characters at the beginning of an IP address string. A remote attacker could possibly use this issue to bypass access controls that are based on IP addresses. This issue only affected Ubuntu 16.04 LTS and Ubuntu...
CVE-2026-49233
creationtimestamp| type| source ---|---|--- 2026-06-08 15:29:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnryrdiyxt2n...
CLEANSTART-2026-LU08936 Security fixes for ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x applied in versions: 1.8.2-r0
Multiple security vulnerabilities affect the fulcio package. These issues are resolved in later releases. See references for individual vulnerability details...
UBUNTU-CVE-2026-8833
Improper neutralization of HTML-encoded characters in the URL validation function in Checkmk 2.5.0p5, 2.4.0p31, 2.3.0p48, and all 2.2.0 versions allows an authenticated user to bypass URL validation and inject malicious URLs such as javascript: URIs, resulting in cross-site scripting when another...
CVE-2026-8833
Improper neutralization of HTML-encoded characters in the URL validation function in Checkmk 2.5.0p5, 2.4.0p31, 2.3.0p48, and all 2.2.0 versions allows an authenticated user to bypass URL validation and inject malicious URLs such as javascript: URIs, resulting in cross-site scripting when another...
CVE-2026-11569
creationtimestamp| type| source ---|---|--- 2026-06-08 12:55:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnrq5vv63p23...
WordPress Email Address Encoder plugin < 1.0.25 - Unauthenticated Stored XSS vulnerability
Unauthenticated Stored XSS vulnerability discovered by Matthew Rollings in WordPress Plugin Email Address Encoder versions 1.0.25...
CVE-2026-8833 XSS in urls
Improper neutralization of HTML-encoded characters in the URL validation function in Checkmk 2.5.0p5, 2.4.0p31, 2.3.0p48, and all 2.2.0 versions allows an authenticated user to bypass URL validation and inject malicious URLs such as javascript: URIs, resulting in cross-site scripting when another...
CVE-2026-9506
creationtimestamp| type| source ---|---|--- 2026-06-08 11:30:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnrlfqxm5c2t...