33670 matches found
PT-2026-103712
A vulnerability was found in datadrivenconstruction OpenConstructionERP up to 14.8.1. The impacted element is an unknown function of the file backend/app/modules/ai/ai client.py of the component Al Provider Configuration Handler. Performing a manipulation results in exposure of data element to...
PT-2026-103922
Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.60 through 2.4.68 Description A deployment of wrong handler issue allows the target of certain internal redirects from CGI programs to be treated as CGI and executed. This occurs if the target is located in a...
AlmaLinux 9.2 [TuxCare] Security Update: qt5-qt3d / qt5-qt3d-devel / qt5-qt3d-examples / qt5-qt3d-tests Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1763033515)
The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1763033515 advisory. - A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. Affected by this issu...
CentOS Linux 7 [TuxCare] Security Update: expat / expat-devel / expat-static (CENTOS7:CLSA-2026:1770735514)
The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1770735514 advisory. - In libexpat before 2.7.4, XMLExternalEntityParserCreate does not copy unknown encoding handler user data. CVE-2026-24515 Note that Nessus has n...
AlmaLinux 9.2 [TuxCare] Security Update: expat / expat-devel / expat-static (ALMALINUX9.2:CLSA-2026:1770741587)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1770741587 advisory. - In libexpat before 2.7.4, XMLExternalEntityParserCreate does not copy unknown encoding handler user data. CVE-2026-24515 Note that Nessus h...
Linux Distros Unpatched Vulnerability : CVE-2026-103387
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A weakness has been identified in garycourt uri-js up to 4.4.1. This affects the function URI.parse of the file src/schemes/mailto.ts of the component Mailto...
PT-2026-103910
In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's Authorization header to outgoing requests without checking the destination origin. In deployments using authentication, an attacker could induce a us...
PT-2026-103656
A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/utils/access.ts of the component Shared Link Preview Handler. The manipulation of the argument Password leads to improper authorization. The attack may be...
CVE-2026-90974: Missing Authorization
The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization, allowing unauthenticated users to overwrite the site's CRM integration endpoint and credentials, after which synced user data is delivered to an...
CentOS Linux 8.4 [TuxCare] Security Update: expat / expat-devel / expat-static (CENTOS8.4:CLSA-2026:1789142708)
The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1789142708 advisory. - libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after- free can occur. NOTE: this is...
Rocky Linux 9.6 [TuxCare] Security Update: expat / expat-devel / expat-static Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1784290625)
The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784290625 advisory. - libexpat before 2.8.2 lacks handler call depth tracking for calls to XMLGetBuffer, XMLParse, XMLParseBuffer, XMLParserFree, or...
GHSA-P68Q-WCHP-6FH7 fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
Impact Fastify routes a malformed URL under one plugin prefix to the custom not-found handler of a different sibling plugin, invoking the handler registered last and skipping the preHandler declared in its setNotFoundHandler. When the request method has no route in the main router, a malformed...
EUVD-2026-70989
fastify vulnerable to request validation bypass via skipped boolean false schemas...
russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened
Summary CVE-2026-68930 was fixed by adding Session::isestablishedchannel in russh/src/server/encrypted.rs, which gates every channel-scoped SERVER-side message CHANNELREQUEST, CHANNELDATA, CHANNELEOF, CHANNELCLOSE, CHANNELWINDOWADJUST, CHANNELEXTENDEDDATA on enc.channels.get&channel.issomeand|c|...
GHSA-47HW-GVQ5-R2GM russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened
Summary CVE-2026-68930 was fixed by adding Session::isestablishedchannel in russh/src/server/encrypted.rs, which gates every channel-scoped SERVER-side message CHANNELREQUEST, CHANNELDATA, CHANNELEOF, CHANNELCLOSE, CHANNELWINDOWADJUST, CHANNELEXTENDEDDATA on enc.channels.get&channel.issomeand|c|...
CVE-2026-102143
An unauthenticated attacker could cause a file with attacker-controlled content to be written to the appliance filesystem through an administrative upload handler that did not properly authenticate the request. This did not by itself result in code execution, which would require a separate...
CVE-2026-103387
A weakness has been identified in garycourt uri-js up to 4.4.1. This affects the function URI.parse of the file src/schemes/mailto.ts of the component Mailto Header Handler. This manipulation of the argument to causes uncaught exception. The attack may be initiated remotely. The exploit has been...
DEBIAN-CVE-2026-103387
A weakness has been identified in garycourt uri-js up to 4.4.1. This affects the function URI.parse of the file src/schemes/mailto.ts of the component Mailto Header Handler. This manipulation of the argument to causes uncaught exception. The attack may be initiated remotely. The exploit has been...
AZL-105351 CVE-2026-103387 affecting package js-jquery 3.5.0-4
A weakness has been identified in garycourt uri-js up to 4.4.1. This affects the function URI.parse of the file src/schemes/mailto.ts of the component Mailto Header Handler. This manipulation of the argument to causes uncaught exception. The attack may be initiated remotely. The exploit has been...
CVE-2026-103387
A weakness has been identified in garycourt uri-js up to 4.4.1. This affects the function URI.parse of the file src/schemes/mailto.ts of the component Mailto Header Handler. This manipulation of the argument to causes uncaught exception. The attack may be initiated remotely. The exploit has been...