CVE-2025-0108-SCAN

CVE-2025-0108 PAN-OS: Authentication Bypass in the Management Web Interface An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS...

AlmaLinux 9.6 [TuxCare] Security Update: skopeo / skopeo-tests (ALMALINUX9.6:CLSA-2026:1776968105)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1776968105 advisory. - url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 Note that Nessus has not...

Security Bulletin: This Power System update is being released to address CVE-2026-96261

Summary Power Systems Firmware is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the service processor can write specially crafted configuration data, causing the host firmware boot stack to crash with possible memory...

Linux Distros Unpatched Vulnerability : CVE-2026-100664

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host header...

Incorrect Behavior Order: Validate Before Canonicalize

Overview PyJWT is a Python implementation of RFC 7519. Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize via the load method in jwt/apijws.py, which accepts non-canonical base64url-encoded JWS segments. Because the library does not verify...

Improper Input Validation

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Improper Input Validation via insufficient hardening of runtime option handling in the fetch and HTTP adapters, where user-supplied fetchOptions are merge...

Improper Input Validation

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Improper Input Validation via insufficient hardening of runtime option handling in the fetch and HTTP adapters, where user-supplied fetchOptions are merged into the...

Atlassian Confluence 8.9.x < 9.2.24 / 9.3.x < 10.2.17 (CONFSERVER-104443)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104443 advisory. - In Bouncy Castle for Java before 1.85, MTI/A0 DH agreement exponentiates unvalidated peer value. This issue also affects Bouncy Castle for Java L...

Use of Less Trusted Source

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Use of Less Trusted Source via incomplete propagation of revision and coderevision pins across artifact boundaries in the model loader subsystem. Wh...

CVE-2026-100664

Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form HTTP/1 request-target. In HttpConversionUtil.toHttp3HeadersHttpMessage, boolean —...

CVE-2026-100664

Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form HTTP/1 request-target. In HttpConversionUtil.toHttp3HeadersHttpMessage, boolean —...

UBUNTU-CVE-2026-100664

Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form HTTP/1 request-target. In HttpConversionUtil.toHttp3HeadersHttpMessage, boolean —...

EUVD-2026-87758

Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form HTTP/1 request-target. In HttpConversionUtil.toHttp3HeadersHttpMessage, boolean —...

CVE-2026-100664 Netty 4.2.2 through 4.2.17 HTTP/1 Host Header Authority Confusion

Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form HTTP/1 request-target. In HttpConversionUtil.toHttp3HeadersHttpMessage, boolean —...

CVE-2026-100664 Netty 4.2.2 through 4.2.17 HTTP/1 Host Header Authority Confusion

Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form HTTP/1 request-target. In HttpConversionUtil.toHttp3HeadersHttpMessage, boolean —...

CVE-2026-100664

The Netty HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final is vulnerable to authority confusion . In the HttpConversionUtil.toHttp3Headers method, a non-empty Host header takes precedence over the request-target authority during HTTP/1-to-HTTP/3 conversion, viol...

CVE-2026-100596

Versions of OpenClaw prior to 2026.7.1 are vulnerable to an authorization bypass that allows non-owner users to execute MCP configuration changes via the /mcp set and /mcp unset commands. By exploiting this flaw, an attacker can persist arbitrary stdio MCP commands which execute with the OpenClaw...

EUVD-2026-87107

IBM Server Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the ASMI web interface. An unauthenticated attacker on the management network can send a malformed HTTPS request to ASMI,...

ROS-20260925-73-0028

The vulnerability of the BPFCALL4 function in the net/core/filter.c module related to the execution of kernel network functions in Linux operating systems involves a pointer shift beyond the allocated memory range. Exploiting this vulnerability could allow an attacker to compromise the...

CVE-2026-17503

IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the partition firmware runtime boot configuration. An attacker with root access to a partition can maliciously alter...