71645 matches found
CVE-2026-63443
Coder (a Terraform-based remote development environment provisioner) is affected by an insecure redirect handling flaw in agentConn.apiClient(). The client used the default http.Client redirect behavior while its custom transport dialed the host from the request URL whenever the port matched the ...
CVE-2026-45764
A type confusion flaw was found in Suricata's HTTP/2 protocol parsing engine. When processing network traffic, Suricata fails to properly validate protocol state transitions during HTTP/2 frame handling. A remote, unauthenticated attacker could exploit this vulnerability by transmitting specially...
CVE-2026-91949
FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections despite server policy disabling them. Attackers can send incompatible protocol requests, receive negotiation failures, then complete TLS...
CVE-2026-1759
Improper handling of insufficient permissions or privileges vulnerability in Secomea GateManager allows Privilege Escalation. This issue affects GateManager: 11.5;0, 11.4.625515072:0. Fixed in Version 11.6 or 11.4.626194074 and above...
Improper Handling of Case Sensitivity
Overview org.webjars.npm:fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity due to inconsistent normalization in the host component. An attacker can gain unauthorized access to restricted resources or servic...
EUVD-2026-78350
Affected versions of MISP can record incorrect access-log data for requests that terminate in an exception. Because CakeErrorController extends AppController, exception rendering runs the application startup path a second time. As a result, accessMonitor calls AccessLog::logRequest twice for one...
kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink()
A flaw was found in the Linux kernel's IPv6 Virtual Tunnel Interface vti6 component. An unprivileged local user, particularly within a user namespace, could exploit a vulnerability related to incorrect network namespace handling during the movement of a vti6 tunnel. This issue can lead to a kerne...
USN-8759-1: WebOb vulnerabilities
It was discovered that WebOb incorrectly handled certain URLs. An attacker could possibly use this issue to control a redirect or forward to another URL. This issue was only addressed in Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. CVE-2024-42353 Caleb Brown discovered that WebOb incorrectly handled...
USN-8759-1 python-webob vulnerabilities
It was discovered that WebOb incorrectly handled certain URLs. An attacker could possibly use this issue to control a redirect or forward to another URL. This issue was only addressed in Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. CVE-2024-42353 Caleb Brown discovered that WebOb incorrectly handled...
kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation
A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM nSVM module. When a nested virtual machine L2 guest executes VMSAVE/VMLOAD instructions, and these are not intercepted by the first-level hypervisor L1, KVM incorrectly uses vmcb02 instead of vmcb01 for managing guest state...
kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation
A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM nSVM module. When a nested virtual machine L2 guest executes VMSAVE/VMLOAD instructions, and these are not intercepted by the first-level hypervisor L1, KVM incorrectly uses vmcb02 instead of vmcb01 for managing guest state...
PT-2026-91925
Improper handling of insufficient permissions or privileges vulnerability in Secomea GateManager allows Privilege Escalation. This issue affects GateManager: 11.5;0, 11.4.625515072:0. Fixed in Version 11.6 or 11.4.626194074 and above...
PT-2026-92191
pdfforge PDF Architect App Object Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target must...
CVE-2026-81927: Improper Neutralization of Input During Web Page Generation
Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processing was set to the non-default "Reject files containing potentially harmful elements" mode concrete.filemanager.images.svgsanitization.action = reject, uploaded SVGs were checked...
ROS-20260915-73-0131
The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to errors in handling HTTP requests. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...
PT-2026-93212
Netcore NR255-V version 1.5.130703 contains an out-of-bounds read vulnerability in filter arp put file.cgi caused by improper use of a string handling API. Attackers can trigger an unterminated buffer over-read by exploiting this flaw in the affected component, potentially exposing adjacent memor...
AlmaLinux 10 : python-tornado (ALSA-2026:67147)
The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:67147 advisory. tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects CVE-2026-49853 tornado: Tornado: Denial of Service v...
Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : Konsole vulnerability (USN-8752-1)
The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8752-1 advisory. It was discovered that Konsole incorrectly handled certain URLs under specific circumstances. A remote attacker could possibly...
CVE-2026-92257: Improper Neutralization of Input During Web Page Generation
Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in L7 content management pages that use eval sinks, affecting the call board text and policy group handling components. Attackers can inject persistent script payloads through these pages to have malicious cod...