76 matches found
CVE-2019-9673
CVE-2019-9673: Freenet content filter vulnerability NOTE: I have fully disclosed this bug to the Freenet team and worked with them to verify their patch. The patch is now deployed in the latest version of Freenet. I've recently found a security vulnerability in Freenet that may allow an attacker ...
Medium: runc
Issue Overview: x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN entries. This caused strings.Splithost, "." to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically bas...
Amazon Linux 2 : containerd (ALASNITRO-ENCLAVES-2026-118)
The version of containerd installed on the remote host is prior to 2.2.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2026-118 advisory. Fix GHSA-p7v4-vr35-mj6f; containerd CRI plugin: Checkpoint restore bypasses destination security context.A...
Amazon Linux 2023 : containerd, containerd-stress (ALAS2023-2026-2131)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2131 advisory. Fix GHSA-p7v4-vr35-mj6f; containerd CRI plugin: Checkpoint restore bypasses destination security context.A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function...
Amazon Linux 2 : containerd (ALASECS-2026-136)
The version of containerd installed on the remote host is prior to 2.2.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-136 advisory. Fix GHSA-p7v4-vr35-mj6f; containerd CRI plugin: Checkpoint restore bypasses destination security context.A...
Amazon Linux 2 : containerd (ALASDOCKER-2026-140)
The version of containerd installed on the remote host is prior to 2.2.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-140 advisory. Fix GHSA-p7v4-vr35-mj6f; containerd CRI plugin: Checkpoint restore bypasses destination security context.A...
Security Bulletin: Multiple vulnerabilities addressed in IBM SevOne Network Performance Management for August 2026
Summary IBM SevOne Network Performance Management has addressed these security vulnerabilities in the SD-WAN component with a Service Pack update. The publication of this security bulletin represents a change in our communication process, not an increase in security vulnerabilities. IBM SevOne...
Important: runfinch-finch
Issue Overview: On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symboli...
Amazon Linux 2 : golang, --advisory ALAS2-2026-3819 (ALAS-2026-3819)
The version of golang installed on the remote host is prior to 1.25.12-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3819 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final...
Medium: golang-github-burntsushi-toml-test
Issue Overview: On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symboli...
Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2026-1979)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1979 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /...
AZL-92306 CVE-2026-42505 affecting package golang for versions less than 1.25.12-1
Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello...
AZL-92312 CVE-2026-42505 affecting package golang for versions less than 1.26.5-1
Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello...
CVE-2026-42505
Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello...
EUVD-2026-42317
Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello...
CVE-2026-42505 Invoking Encrypted Client Hello privacy leak in crypto/tls
Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello...
PT-2026-56479
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Handshakes using Encrypted Client Hello ECH, a mechanism designed to encrypt the initial handshake of a TLS connection to protect client privacy, could be...
EUVD-2020-18842
Malware in sbrugna...