176 matches found
DEBIAN-CVE-2026-105483
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits １２７.0.0.1. tls.checkServerIdentity did not recognize such hosts as IP...
ALPINE-CVE-2026-105483
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits １２７.0.0.1. tls.checkServerIdentity did not recognize such hosts as IP...
CVE-2026-105483
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits １２７.0.0.1. tls.checkServerIdentity did not recognize such hosts as IP...
CVE-2026-105483
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits １２７.0.0.1. tls.checkServerIdentity did not recognize such hosts as IP...
CVE-2026-93633
Zimbra Collaboration Suite (ZCS) versions 10.1.16 and 10.1.20 are vulnerable to a CSS sanitization bypass within the Briefcase component. The root cause is that the DefangFilter appends the final ASCII segment of a stylesheet containing non-ASCII characters without proper sanitization. This allow...
CVE-2026-93633 Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet Characters
A CSS sanitization vulnerability in Zimbra Collaboration Suite ZCS allows an authenticated user with Briefcase access to publish a document that displays attacker-controlled content under the Zimbra origin. When processing a stylesheet containing non-ASCII characters, DefangFilter appends the fin...
SUSE CVE-2026-105483
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits １２７.0.0.1. tls.checkServerIdentity did not recognize such hosts as IP...
PT-2026-107236
Name of the Vulnerable Software and Affected Versions Apache log4net versions 1.2.12 through 3.4.x Description Improper encoding or escaping of output occurs in the RemoteSyslogAppender. Characters outside visible ASCII and space are removed from the record instead of being escaped, causing...
CVE-2026-67071 HCL DevOps Deploy / HCL Launch is susceptible to an Improper Removal of Sensitive Information Before Storage or Transfer
HCL DevOps Deploy / HCL Launch is susceptible to an information disclosure vulnerability when processing redacted property values. If a deployment is configured with a secure property that starts with certain non-ASCII characters, the redaction engine may fail to mask subsequent ASCII secure valu...
CVE-2026-67071: Improper Removal of Sensitive Information Before Storage or Transfer
HCL DevOps Deploy / HCL Launch is susceptible to an information disclosure vulnerability when processing redacted property values. If a deployment is configured with a secure property that starts with certain non-ASCII characters, the redaction engine may fail to mask subsequent ASCII secure valu...
CVE-2026-78658 IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an information disclosure vulnerability
IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.25, and 7.3 through 7.3.2.20 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.15, 8.1 through 8.1.2.8, and 8.2 through 8.2.2.1 IBM DevOps Deploy / IBM UrbanCode Deploy UCD is susceptible to an formation disclosure vulnerability when processing...
CVE-2026-78658
IBM UrbanCode Deploy (UCD) and IBM DevOps Deploy contain an information disclosure vulnerability (CWE-212) in the redaction engine. When a deployment's secure property begins with certain non-ASCII characters , subsequent ASCII secure values embedded inside unsecure properties may fail to be mask...
EUVD-2026-71399
IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.25, and 7.3 through 7.3.2.20 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.15, 8.1 through 8.1.2.8, and 8.2 through 8.2.2.1 IBM DevOps Deploy / IBM UrbanCode Deploy UCD is susceptible to an formation disclosure vulnerability when processing...
Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an information disclosure vulnerability (CVE-2026-78658)
Summary IBM DevOps Deploy / IBM UrbanCode Deploy UCD is susceptible to an information disclosure vulnerability when processing redacted property values. CVE-2026-78658. Vulnerability Details CVEID:CVE-2026-78658 DESCRIPTION: IBM DevOps Deploy / IBM UrbanCode Deploy UCD is susceptible to an...
PYSEC-2026-1099 AIOHTTP's unicode processing of header values could cause parsing discrepancies
Summary The Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. Impact If a pure Python version of aiohttp is installed i.e. without the usual C extensions or AIOHTTPNOEXTENSIONS is enabled, then an attacker may be able to execute a request smuggling...
DEBIAN-CVE-2025-69224
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. If a pure Python version of AIOHTTP is installed i.e. without the usual C extensions ...
CVE-2025-69224
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. If a pure Python version of AIOHTTP is installed i.e. without the usual C extensions ...
UBUNTU-CVE-2025-69224
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. If a pure Python version of AIOHTTP is installed i.e. without the usual C extensions ...
CVE-2025-69224
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. If a pure Python version of AIOHTTP is installed i.e. without the usual C extensions ...
CVE-2025-69224
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. If a pure Python version of AIOHTTP is installed i.e. without the usual C extensions ...