15518 matches found
PT-2026-91450
Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server 9.0 IBM WebSphere Application Server 8.5 IBM WebSphere Application Server - Liberty affected versions not specified Description Improper parsing of the HTTP transfer-encoding request header allows for HTTP...
Important: git-lfs security update
Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal...
PT-2026-91440
Name of the Vulnerable Software and Affected Versions Squid proxy affected versions not specified Description An issue involving request smuggling in HTTP Transfer-Encoding allows a trusted client to poison the web cache. This enables the storage of arbitrary malicious content at any URL, which c...
AlmaLinux 8 : git-lfs (ALSA-2026:67161)
The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:67161 advisory. encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial of...
RHEL 10 : rhc-worker-playbook (RHSA-2026:67464)
The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:67464 advisory. A worker for yggdrasil that receives Ansible playbooks and executes them against the local host. Security Fixes: encoding/asn1: golang: Go...
PT-2026-91040
Name of the Vulnerable Software and Affected Versions GNU libredwg version 0.13.4 Description A security flaw in the Layer Encoding component exists within the DWG TABLE function of the src/dwg.spec file. A local manipulation can lead to a null pointer dereference, which occurs when raw zeroing...
CVE-2026-90622: NULL Pointer Dereference
A security flaw has been discovered in GNU libredwg 0.13.4. This impacts the function DWGTABLE of the file src/dwg.spec of the component Layer Encoding. Performing a manipulation results in null pointer dereference. The attack needs to be approached locally. The exploit has been released to the...
CVE-2026-73195: Improper Encoding or Escaping of Output
Improper Encoding or Escaping of Output vulnerability in Apache Syncope. Authenticated users can store a spreadsheet formula payload in one of their own plain attributes. When such users are included in a CSV export and the generated CSV file is opened by a spreadsheet application, the formula ma...
Out-of-bounds Read
Overview Affected versions of this package are vulnerable to Out-of-bounds Read due to improper handling of padding in the extradata allocation process within WMA encoding. An attacker can cause a denial of service by triggering an out-of-bounds read through specially crafted input data...
waf-checker v1.2.0
WAF Checker This project helps you check how well your Web Application Firewall WAF protects your product against common web attacks. It can be run as a Cloudflare Worker with a built-in interactive Web UI or as a standalone Node.js CLI tool. 🧪 Test Coverage & Status All packages are thoroughly...
CVE-2026-52296
FFmpeg versions before 9.0 are affected by an out-of-bounds read caused by missing required padding in the WMA extradata allocation paths within libavcodec/wmaenc.c . The vulnerability is rated LOW (CVSS 3.1 score 2.9) with a local attack vector and high complexity, resulting in a limited availab...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libvpx (UTSA-2023-003033)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-003033 advisory. Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libvpx (UTSA-2023-003032)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-003032 advisory. VP9 in libvpx before 1.13.1 mishandles widths, leading to a crash related to encoding. Tenable has extracted the preceding description block directly from the Unity...
Exploit for CVE-2026-85706
cve-2026-85706 Unauthenticated arbitrary local file read in G...
Exploit for Out-of-bounds Write in F5 Nginx
CVE-2013-2028 Exploit Vulnerability Details Vulnerable...
curl: libcurl LDAP LDIF: entry DN and attribute names written without RFC 2849 base64 encoding, allowing server line injection
Summary: curl 8.22.0 base64-encodes LDAP attribute values that aren't RFC 2849 SAFE-STRINGs commit 2ba2fe3540, issue 22339, but the entry DN and the attribute names are still written to the LDIF output verbatim. In lib/openldap.c oldaprecv that's the DN clientwritedata, STRCONST"DN: ", bv.bvval,...
EUVD-2026-76750
A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding, and does not require authentication to reach. This allows an unauthenticated network attacker to craft a link that, when visited by a user, executes arbitrary script in...
CVE-2026-89674
A flaw was found in the nfsd component of the Linux kernel. Incorrect calculations in the XDR External Data Representation buffer size within the nfsd4ffencodelayoutget function can lead to two critical issues. An attacker could potentially exploit this to write data beyond the intended memory...
CVE-2026-90443 Cross-site Scripting in Malcolm
A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding, and does not require authentication to reach. This allows an unauthenticated network attacker to craft a link that, when visited by a user, executes arbitrary script in...