4923 matches found
Siemens SIMATIC S7-1500 CPU 1518 MFP Missing Default Case in Multiple Condition Expression (CVE-2025-39748)
This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505685; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...
CVE-2026-64306
In the Linux kernel, the following vulnerability has been resolved: crypto: drbg - Fix returning success on failure in CTRDRBG drbgctrgenerate sometimes returns success when it fails, leaving the output buffer uninitialized. Fix it...
electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`
Summary In electron-builder's builder-util-runtime package, the HTTP redirect handler HttpExecutor.prepareRedirectUrlOptions only stripped a credential header whose key string matched exactly lowercase "authorization". Other credential-bearing headers — most notably PRIVATE-TOKEN used by GitLab's...
CVE-2026-53402
creationtimestamp| type| source ---|---|--- 2026-07-24 13:25:25+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrfhb3ikw42o 2026-08-06 04:46:30+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260806...
PYSEC-2026-3447
creationtimestamp| type| source ---|---|--- 2026-07-24 09:40:25+00:00| seen| https://gist.github.com/sw1pp3r/00f32e3393b6c6123cc7aeaff3ed9f18...
CVE-2026-54133 vulnerabilities
Vulnerabilities for packages: nextcloud-server...
CVE-2026-15617
Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities...
EUVD-2026-48300
Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities...
CVE-2026-15617 Principal/domain lookup without case normalization
Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities...
CVE-2026-15617 Principal/domain lookup without case normalization
Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities...
CVE-2026-15617
CVE-2026-15617 affects Logto Identity Platform: during SSO, the system performs strict, unnormalized comparisons of identity attributes (email, issuer, identity IDs), allowing sessions to bind to unintended local accounts due to case/whitespace/Unicode differences. This can enable unauthorized ac...
CVE-2026-65911
In DOMPurify through 3.3.3, function predicates supplied via ADDATTR or ADDTAGS to DOMPurify.sanitize persist in internal state EXTRAELEMENTHANDLING across subsequent sanitize calls on the same instance. If a later call on the same instance provides ADDATTR or ADDTAGS as an array rather than a...
CVE-2026-14282
creationtimestamp| type| source ---|---|--- 2026-07-23 13:56:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrcyizk2jv2i...
EUVD-2026-48273
DOMPurify through 3.3.3 fails to sanitize DOM elements passed via INPLACE mode when the element originates from a different window/realm e.g., an iframe's contentDocument. A cross-realm instanceof check in the private isNode function returns false for foreign-realm nodes, causing DOMPurify to...
PYSEC-2026-3466 Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)
Header | Field | Value | |---|---| | Title | Extension-denylist bypass via case-folding asymmetry in name-override path incomplete-fix variant of CVE-2026-27641 | | Project | Flask-Reuploaded flaskuploads | | Affected | extension"shell.php" = "php" - extensionallowed"php" - DENY correct...
tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm
In Apache Tomcat, LockOutRealm mishandled case sensitivity in usernames, resulting in less effective blocking of brute force attacks...
CVE-2026-16631
creationtimestamp| type| source ---|---|--- 2026-07-23 01:46:33+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrbpqjfxpt24...
PT-2026-64021
Name of the Vulnerable Software and Affected Versions Logto affected versions not specified Description Logto performs principal lookup without normalizing email and identifier strings. This lack of normalization allows for principal collision, which can lead to unauthorized account access when...
CVE-2025-50329
creationtimestamp| type| source ---|---|--- 2026-07-22 21:57:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrbcwop3p223 2026-07-24 20:12:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrg5yaz6be2a...