MSC-2026-12959

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass

Pingora versions prior to 0.9.0 accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI session.reqheader.uri saw the :authority value, but the upstream received the client-supplied Host value. Pingora...

CVE-2026-80917

A flaw was found in the Linux kernel's PCI host-generic component. On 32-bit systems utilizing the "pci-host-cam-generic" driver, a missing bus mapping setup during Peripheral Component Interconnect PCI configuration can lead to a NULL pointer dereference. This vulnerability can be triggered duri...

CVE-2026-92479

A flaw was found in the Linux kernel's Universal Flash Storage UFS host controller driver. When an invalid completion queue entry CQE tag is reported, the driver attempts to dereference a NULL pointer, which can lead to a system crash. This vulnerability could allow a local attacker to cause a...

Security Bulletin: Automation Assets in IBM Integration is vulnerable to multiple vulnerabilities in fast-uri

Summary Automation Assets in IBM Integration is vulnerable to multiple vulnerabilities in fast-uri. CVE-2026-84292, CVE-2026-84394, CVE-2026-86472 The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-84292 DESCRIPTION: fast-uri serializes the port component of a URI witho...

CVE-2026-98472

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine AMD SEV Secure Encrypted Virtualization implementation. This flaw allows a local user with permissions to manage virtual machines to cause a denial of service DoS through memory exhaustion. When an SEV guest is destroyed afte...

CVE-2026-98471

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine subsystem for AMD SEV Secure Encrypted Virtualization. During intra-host migration of an encrypted virtual machine, the source virtual machine's CPU caches are not properly flushed before the system reclaims its memory. A loc...

Improper Validation of Specified Quantity in Input

Overview org.webjars.npm:fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via canonicalizeHost, which passes the host directly to new URL'http://' + host without verifying that the WHATWG pars...

Improper Validation of Specified Quantity in Input

Overview fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via canonicalizeHost, which passes the host directly to new URL'http://' + host without verifying that the WHATWG parser consumed the...

Exploit for CVE-2026-99999

CVE-2026-99999 Working PoC — Setup & Usage Guide ⚠️ This...

CVE-2026-92287 Apache Arrow C++, PyArrow: Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation

Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects users who read Parquet files and configure Parquet decryption properties with a KmsClient implementation. On the reader side, the KMS URL can be application-controlled...

CVE-2026-92287 Apache Arrow C++, PyArrow: Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation

Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects users who read Parquet files and configure Parquet decryption properties with a KmsClient implementation. On the reader side, the KMS URL can be application-controlled...

CVE-2026-92287 Apache Arrow C++, PyArrow: Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation

Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects users who read Parquet files and configure Parquet decryption properties with a KmsClient implementation. On the reader side, the KMS URL can be application-controlled...

CVE-2026-92287

A vulnerability exists in Apache C++ Parquet and PyArrow (versions 4.0.0 to 25.0.1) where unvalidated KMS URLs embedded in Parquet files are passed to pluggable KmsClient implementations. If a user does not specify a KMS URL in the KmsConnectionConfig, the application falls back to the file-contr...

CVE-2026-110180

A flaw was found in fast-uri. When processing web addresses, the host canonicalization mechanism can silently strip control characters or drop user information without verifying that the full host input was consumed. A remote attacker can exploit this parsing discrepancy by supplying a specially...

DEBIAN-CVE-2026-110180

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1 through 4.2.2, for HTTP-family schemes the canonicalizeHost function passes the parsed host to the WHATWG URL parser and adopts its hostname...

CVE-2026-110180

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1 through 4.2.2, for HTTP-family schemes the canonicalizeHost function passes the parsed host to the WHATWG URL parser and adopts its hostname...

Exploit for CVE-2026-99999

CVE-2026-99999 Scanner English | 한국어 A s...

CVE-2026-110180 fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1 through 4.2.2, for HTTP-family schemes the canonicalizeHost function passes the parsed host to the WHATWG URL parser and adopts its hostname...

CVE-2026-110180 fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1 through 4.2.2, for HTTP-family schemes the canonicalizeHost function passes the parsed host to the WHATWG URL parser and adopts its hostname...