CVE-2020-2034-POC

CVE-2020-2034-POC Determine the Version Running on the Palo Alto Network Firewall for the Global Protect Portal Recently a lot of critical vulnerabilities were announced by Palo Alto Networks here: https://security.paloaltonetworks.com/?severity=CRITICAL&product=PAN-OS&sort=-date This is a PoC to...

Curl 7.20.0 < 8.23.0 Local File Overwrite

The version of curl installed on the remote host is 7.20.0 prior to 8.23.0. It is, therefore, affected by a file overwrite vulnerability: - When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response...

LXC Incus encryption issue vulnerability

Versions LXC Incus prior to 7.0.0 and 7.1.0 up to 7.5.0 contain an encryption vulnerability stemming from a flaw in the signature validation of the built-in S3 server. This flaw allows pre-signed URL holders to inject unsigned x-amz- headers, potentially enabling them to copy objects from other...

SUSE CVE-2026-111946

Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header. When the response body is a filehandle and the fileetag option is not set, the ETag is built from the file's inode number, modification time and size. Clients receiving affected...

CVE-2026-92390

The curl utility (versions prior to 8.23.0 ) is vulnerable to a local file overwrite flaw when using the --remote-header-name (-J) flag. The root cause is a failure to preserve documented anti-clobbering protections under specific conditions: if an intermediate 103 Early Hints response precedes t...

CVE-2026-92390 -J no-clobber guarantee bypassed with 103 early hints

When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTPS serve...

CVE-2026-92390

When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTPS serve...

Curl input validation vulnerability

The Curl version 7.20.0 to 8.22.0 contains a vulnerability related to input validation errors. This vulnerability arises when using the --remote-header-name -J option. If the intermediate 103 Early Hints response arrives before the final HTTP response, or if the ETag header is processed before...

Red Hat: CVE-2026-92390: curl: curl: -J no-clobber guarantee bypassed with 103 early hints

When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTPS serve...

CVE-2026-111946

Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header. When the response body is a filehandle and the fileetag option is not set, the ETag is built from the file's inode number, modification time and size. Clients receiving affected...

EUVD-2026-104605

Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header. When the response body is a filehandle and the fileetag option is not set, the ETag is built from the file's inode number, modification time and size. Clients receiving affected...

CVE-2026-111946 Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header

Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header. When the response body is a filehandle and the fileetag option is not set, the ETag is built from the file's inode number, modification time and size. Clients receiving affected...

CVE-2026-111946 Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header

Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header. When the response body is a filehandle and the fileetag option is not set, the ETag is built from the file's inode number, modification time and size. Clients receiving affected...

CVE-2026-111946

The Plack::Middleware::ETag Perl component (versions 0.04 through 0.06 ) is vulnerable to sensitive information disclosure. When the response body is a filehandle and the file_etag option is not configured, the middleware constructs the ETag header using the file's inode number , modification tim...

CVE-2026-111946

Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header. When the response body is a filehandle and the fileetag option is not set, the ETag is built from the file's inode number, modification time and size. Clients receiving affected...

CVE-2026-111946 Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header

Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header. When the response body is a filehandle and the fileetag option is not set, the ETag is built from the file's inode number, modification time and size. Clients receiving affected...

CVE-2026-111946: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header. When the response body is a filehandle and the fileetag option is not set, the ETag is built from the file's inode number, modification time and size. Clients receiving affected...

PT-2026-117641

Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header. When the response body is a filehandle and the file etag option is not set, the ETag is built from the file's inode number, modification time and size. Clients receiving affecte...

CURL-CVE-2026-92390 -J no-clobber guarantee bypassed with 103 early hints

When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTPS serve...

CVE-2026-82982

The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after they reviewed it. The backend only enforced this check when the etag parameter was present and...