151372 matches found
Ubuntu 24.04 LTS / 25.10 : AMD Microcode vulnerabilities (USN-8475-1)
The remote Ubuntu 24.04 LTS / 25.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8475-1 advisory. Oleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Kpf, Stavros Volos, and Flavien Solt discovered that some AMD processors may allow an...
CVE-2026-53131
A flaw was found in the Linux kernel's netfilter component. Certain netfilter modules, including ip6teui64 and xtmac, accessed Ethernet MAC header data without first verifying that an Ethernet device was associated with the network packet or that the MAC header was present and of sufficient lengt...
CVE-2026-53072
A flaw was found in the Linux kernel's Bluetooth subsystem. Improper handling of locking within the hciconnrequestevt function, particularly when the HCIPROTODEFER protocol is active, can result in a Use-After-Free UAF vulnerability. This condition arises when a connection object is accessed afte...
CVE-2026-40083
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have SQL Injection through unsanitized unserialize+implode in managers.php. At line 756 of managers.php, the application assigns $selecteditems by calling...
GO-2026-5763 Sigstore Timestamp Authority has Improper Certificate Validation in verifier in github.com/sigstore/timestamp-authority
Sigstore Timestamp Authority has Improper Certificate Validation in verifier in github.com/sigstore/timestamp-authority...
GO-2026-5751 Argo has Missing Authorization in its Sync ConfigMap Provider in github.com/argoproj/argo-workflows
Argo has Missing Authorization in its Sync ConfigMap Provider in github.com/argoproj/argo-workflows...
GO-2026-5670 Focalboard doesn't validate file ownership when serving uploaded files in github.com/mattermost/focalboard
Focalboard doesn't validate file ownership when serving uploaded files in github.com/mattermost/focalboard...
GO-2026-5661 Gogs has DOM-based XSS via Milestone Name on New Issue Page in gogs.io/gogs
Gogs has DOM-based XSS via Milestone Name on New Issue Page in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...
GO-2026-5690 opentelemetry-collector-contrib: githubreceiver silently ignores configured required_headers authentication in github.com/open-telemetry/opentelemetry-collector-contrib/receiver/githubreceiver
opentelemetry-collector-contrib: githubreceiver silently ignores configured requiredheaders authentication in github.com/open-telemetry/opentelemetry-collector-contrib/receiver/githubreceiver...
GO-2026-5547 in-toto-golang and in-toto-python have inconsistent negation behavior in github.com/in-toto/in-toto-golang
in-toto-golang and in-toto-python have inconsistent negation behavior in github.com/in-toto/in-toto-golang...
GO-2026-5425 Ironic Standalone Operator's controller modifies user-owned resources without consent in github.com/metal3-io/ironic-standalone-operator
Ironic Standalone Operator's controller modifies user-owned resources without consent in github.com/metal3-io/ironic-standalone-operator...
GO-2026-5442 Mattermost doesn't enforce the PostEditTimeLimit on non-message post fields in github.com/mattermost/mattermost-server
Mattermost doesn't enforce the PostEditTimeLimit on non-message post fields in github.com/mattermost/mattermost-server...
GO-2026-5412 Nginx-UI: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim in github.com/0xJacky/Nginx-UI
Nginx-UI: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim in github.com/0xJacky/Nginx-UI. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2026-5403 Memos has an Incorrect Privilege Assignment issue in github.com/usememos/memos
Memos has an Incorrect Privilege Assignment issue in github.com/usememos/memos...
CVE-2026-7532
iPAddress name constraints bypass when WOLFSSLIPALTNAME is not defined. IP address name constraints are not enforced in that configuration, allowing a certificate to bypass an issuing CA's IP address constraints...
DEBIAN-CVE-2026-6092
When HAVEENCRYPTTHENMAC is configured, the implementation could fall back to MAC-then-Encrypt rather than enforcing Encrypt-then-MAC...
CVE-2025-71328 Flowise - Unverified Password Change via Account Settings
Flowise before 3.0.10 contains an unverified password change vulnerability. An authenticated user can change their account password through the account settings Security section without supplying the current password or any additional verification, as the application does not enforce a...
CVE-2026-8720 HMAC-BLAKE2 final discards message when key length exceeds block size
wcBlake2bHmacFinal and wcBlake2sHmacFinal discard the message when the key length exceeds the block size, producing a MAC that is independent of the input. When the supplied key is longer than the BLAKE2 block size the key-hashing branch reinitialized the running hash state, discarding the...
CVE-2026-10098
OCSP CertID serial-number length-confusion in wolfSSLOCSPrespfindstatus allows a same-issuer SingleResponse whose serial is a prefix of the target serial to be reported as the revocation status of a different certificate. The lookup compared serial-number bytes without first requiring the two...
