2707 matches found
CVE-2026-76073 Label Studio through 1.23.0 Cross-Organization Annotation Access via Unscoped AnnotationAPI Queryset
Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in labelstudio/tasks/api.py declares queryset = Annotation.objects.all and provides no getqueryset override, so the default lookup retrieves any annotation by primary key. The view's...
JLSEC-2026-1377
Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a parent domain can impersonate deeper subdomains to a client using the built-in TLS stack. The mgtlsverifycertsan and mgtlsverifycertcn functions in...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: LoongArch: Move jumplabelinit before parseearlyparam. When both CONFIGMEMALLOCPROFILING=y and CONFIGMEMALLOCPROFILINGENABLEDBYDEFAULT=y are enabled, disabling memory profiling by adding the boot parameter 'sysctl.vm.memprofiling=...
Astra Linux – Vulnerability in libidn2
GNU libidn2 before version 2.2.0 fails to perform the round-trip checks specified in RFC3490, Section 4.2, when converting A-labels to U-labels. This allows, under certain circumstances, one domain to impersonate another. By creating a malicious domain that matches a target domain except for the...
Astra Linux – Vulnerability in avahi
A vulnerability was discovered in Avahi. There exists a potentially exploitable assertion in the avahiescapelabel function...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: locking/csdlock: The csdlockdebug parameter should be changed from earlyparam to setup. The csdlockdebug kernel-boot parameter is processed by the earlyparam function csdlockdebug. If this parameter is set, csdlockdebug invokes...
Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Added NULL pointer dereferencing checking at the end of attrallocateframe. It is preferable to exit through the out: label because internal debugging functions are located there...
PT-2026-80987
Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in label studio/tasks/api.py declares queryset = Annotation.objects.all and provides no get queryset override, so the default lookup retrieves any annotation by primary key. The view's...
CVE-2026-76073: Authorization Bypass Through User-Controlled Key
Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in labelstudio/tasks/api.py declares queryset = Annotation.objects.all and provides no getqueryset override, so the default lookup retrieves any annotation by primary key. The view's...
Fedora 44 : perl-URI (2026-32b0d26c4c)
The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-32b0d26c4c advisory. 5.36 - Apply Unicode NFC normalization in URI::idna nameprep so IDNA host encoding matches other clients instead of emitting a non-standard, non-round-trippi...
GHSA-MHMQ-MMQJ-2V39
creationtimestamp| type| source ---|---|--- 2026-08-21 23:00:09+00:00| seen| https://t.me/pphmHackerNews/1832 2026-08-22 00:00:26+00:00| seen| https://t.me/pphmHackerNews/1832 2026-08-23 00:00:43+00:00| seen| https://t.me/pphmHackerNews/1832...
resolv: Resolv gem: DNS allowlist and egress bypass, and cache poisoning via crafted hostnames
A flaw was found in the resolv gem. This vulnerability arises from the incorrect handling of DNS label lengths during message encoding. A remote attacker could exploit this by providing a specially crafted hostname to an application utilizing the resolv gem. This could lead to the bypass of...
resolv: Resolv gem: DNS allowlist and egress bypass, and cache poisoning via crafted hostnames
A flaw was found in the resolv gem. This vulnerability arises from the incorrect handling of DNS label lengths during message encoding. A remote attacker could exploit this by providing a specially crafted hostname to an application utilizing the resolv gem. This could lead to the bypass of...
golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...
CVE-2026-73253
Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a parent domain can impersonate deeper subdomains to a client using the built-in TLS stack. The mgtlsverifycertsan and mgtlsverifycertcn functions in...
DEBIAN-CVE-2026-73253
Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a parent domain can impersonate deeper subdomains to a client using the built-in TLS stack. The mgtlsverifycertsan and mgtlsverifycertcn functions in...
CVE-2026-66788 Lighthouse: dockerfile build stages use end-of-life fedora 40 referenced by mutable tag
A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized...
CVE-2026-73253
Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a parent domain can impersonate deeper subdomains to a client using the built-in TLS stack. The mgtlsverifycertsan and mgtlsverifycertcn functions in...
CVE-2026-73253
Mongoose (embedded web server and network library) prior to version 7.22 is vulnerable to a TLS hostname verification bypass . The root cause is in mg_tls_verify_cert_san() and mg_tls_verify_cert_cn() (in src/tls_builtin.c), which call mg_match() — a function whose wildcard matching can cross DNS...
resolv: Resolv gem: DNS allowlist and egress bypass, and cache poisoning via crafted hostnames
A flaw was found in the resolv gem. This vulnerability arises from the incorrect handling of DNS label lengths during message encoding. A remote attacker could exploit this by providing a specially crafted hostname to an application utilizing the resolv gem. This could lead to the bypass of...