dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability

Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network...

dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability

Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network...

dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability

Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-109576

The parser in PEAK-System PCAN driver correctly detected the malformed record, but the loop iterating the record list advanced its processed-bytes counter even when a record had been rejected as invalid...

CVE-2026-113239

Range error in SiteIsolation in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-113239

A range error within the SiteIsolation component in Google Chrome on Android (versions prior to 156.0.8078.47 ) allows a remote attacker to execute arbitrary code inside the sandbox. This vulnerability can be triggered by a remote attacker through a crafted HTML page . While the Chromium security...

CVE-2026-92386

The curl utility (versions prior to 8.23.0 ) is vulnerable to a cookie jar parsing issue (CWE-1284). A remote HTTP server can force curl to write a record to a Netscape cookie jar that exceeds its line-length parsing limit. This causes subsequent curl invocations using the --cookie flag to silent...

CVE-2026-92386 server-set cookie aborts cookie jar load

When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make curl write a record that exceeds its line-length parsing limit. Consequently, any subsequent curl invocation reading from that same cookie jar using --cookie silently aborts parsing prematurely upon...

CVE-2026-87863

An authenticated HTTPS origin can supply an HSTS max-age value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache...

Directory Traversal

Overview @apostrophecms/import-export is an Import Export Documents for ApostropheCMS Affected versions of this package are vulnerable to Directory Traversal due to incomplete path validation and missing write-stream error handling during archive extraction. An authenticated attacker with import...

CVE-2026-113664

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a tar entry whose normalized destination targets a directory while bypassing the literal parent-path substring guard. Opening that directory as a wri...

CVE-2026-89577

A flaw was found in the Linux kernel's device mapper I/O dm-io and RAID1 dm-raid1 components. Incorrect error handling for non-retryable errors such as BLKSTSNOTSUPP and BLKSTSINVAL could lead to misbehavior when a user utilizes unaligned bio vectors on dm-raid1. This misbehavior could potentiall...

CVE-2026-93244

A flaw was found in the Linux kernel's simpledrm driver. The driver fails to properly validate the computed display buffer stride, the byte width of a row of pixels, against the maximum integer limit. A local user could exploit this flaw to trigger calculation errors, leading to a kernel crash an...

CVE-2026-96234

A flaw was found in .NET. An origin validation error allows an unauthorized remote attacker to disclose sensitive information over the network. Successful exploitation requires user interaction and enables an attacker to access restricted data without proper authorization...

CVE-2026-113664

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a tar entry whose normalized destination targets a directory while bypassing the literal parent-path substring guard. Opening that directory as a wri...

CVE-2026-113664

The ApostropheCMS Node.js content management system contains a vulnerability in the import-export module prior to version 3.7.0 . An authenticated importer can bypass the literal parent-path substring guard by submitting a tar entry whose normalized destination targets a directory (e.g., using ./...

CVE-2026-113664 ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a tar entry whose normalized destination targets a directory while bypassing the literal parent-path substring guard. Opening that directory as a wri...

EUVD-2026-105211

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a tar entry whose normalized destination targets a directory while bypassing the literal parent-path substring guard. Opening that directory as a wri...

CVE-2026-113664 ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a tar entry whose normalized destination targets a directory while bypassing the literal parent-path substring guard. Opening that directory as a wri...

CVE-2026-113664 ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a tar entry whose normalized destination targets a directory while bypassing the literal parent-path substring guard. Opening that directory as a wri...