1421 matches found
EUVD-2026-48789
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth OnAuth has two bugs in the shared-key authentication path. When the Privacy bit is set, rtwwepdecrypt is called without verifying that the frame is long enough t...
CVE-2026-64445 staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth OnAuth has two bugs in the shared-key authentication path. When the Privacy bit is set, rtwwepdecrypt is called without verifying that the frame is long enough t...
CVE-2026-64445
The CVE-2026-64445 record documents concrete fixes in the Linux kernel (staging: rtl8723bs) for WEP-related issues in the OnAuth() path. Specifically, a vulnerability existed where rtw_wep_decrypt() could read beyond the frame when the frame length was shorter than WLAN_HDR_A3_LEN + iv_len + icv_...
PT-2026-64669
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read issue exists in the SMB client. The smb2 check message function incorrectly applies a one-byte length exemption unconditionally, regardless of whether the command...
PT-2026-64666
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The OnAuth function in the rtl8723bs staging driver contains two issues in the shared-key authentication path. First, when the Privacy bit is set, rtw wep decrypt is called without...
Improper Verification of Source of a Communication Channel
Overview next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Improper Verification of Source of a Communication Channel via improper binding of OAuth check cookies to the provider that created them. An attacker can gain unauthorized access to a victim's...
[SECURITY] Fedora 44 Update: nginx-mod-js-challenge-0^20230517.gitda6852d-11.fc44
Simple JavaScript proof-of-work based access for Nginx with virtually no over head...
Fedora 44 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2026-60fc198d3b)
The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-60fc198d3b advisory. nginx-mod-fancyindex: - Rebuild for 1.30.4 nginx-mod-modsecurity: - Rebuild for 1.30.4 nginx-mod-naxsi: - Rebuild for 1.30.4 nginx-mod-headers-more:...
CVE-2026-8169
ExtremeXOS EXOS uses a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value is generated using an insufficiently random source, which under certain conditions may allow an attacker to predict the expected response and activate debug-mode...
CVE-2026-8169
ExtremeXOS EXOS uses a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value is generated using an insufficiently random source, which under certain conditions may allow an attacker to predict the expected response and activate debug-mode...
CVE-2026-8169 ExtremeXOS Debug-Mode Privilege Escalation via Weak PRNG
ExtremeXOS EXOS uses a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value is generated using an insufficiently random source, which under certain conditions may allow an attacker to predict the expected response and activate debug-mode...
EUVD-2026-46047
ExtremeXOS EXOS uses a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value is generated using an insufficiently random source, which under certain conditions may allow an attacker to predict the expected response and activate debug-mode...
PT-2026-61669
Name of the Vulnerable Software and Affected Versions ExtremeXOS EXOS affected versions not specified Description ExtremeXOS EXOS employs a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value is generated using an insufficiently random sourc...
CVE-2026-63886 scsi: target: iscsi: Validate CHAP_R length before base64 decode
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Validate CHAPR length before base64 decode chapservercomputehash allocates clientdigest as kzallocchap-digestsize and then, for BASE64-encoded responses, passes chapr directly to chapbase64decode without...
CVE-2026-48978
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as...
EUVD-2026-45295
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as...
CVE-2026-48978
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as...
CVE-2026-62232 Grav < 2.0.4 2FA Bypass via Secret Regeneration
Grav before 2.0.4 contains a two-factor authentication bypass vulnerability in the login plugin where the regenerate2FASecret task checks only user existence, not authorization, during the pending TOTP challenge window. Attackers who know the victim's password can call this task without a CSRF...
CVE-2026-62232 Grav < 2.0.4 2FA Bypass via Secret Regeneration
Grav before 2.0.4 contains a two-factor authentication bypass vulnerability in the login plugin where the regenerate2FASecret task checks only user existence, not authorization, during the pending TOTP challenge window. Attackers who know the victim's password can call this task without a CSRF...