15781 matches found
PT-2026-97916
Name of the Vulnerable Software and Affected Versions Norwegian Cruise Line door access controllers affected versions not specified Description An authentication bypass exists in RFID-based door access controllers where the system grants entry based solely on the static 7-byte UID of an NTAG212 N...
CVE-2026-75907: Improper Authentication
The door access control on a Norwegian Cruise Line asset grants entry based only on the credential's static 7-byte UID stored on an NTAG212 NFC chip. A UID is a manufacturer serial number sent in the clear on every read and is not intended to be secret or to authenticate the holder. Validating on...
Norwegian Cruise Line door access controller contains an improper authentication vulnerability
Overview Door access controllers used on Norwegian Cruise Line NCL ships contain an improper authentication vulnerability that permits a replayed unique identifer UID from a radio-frequency identification RFID device to grant unauthorized entry to areas secured by these controllers. Description...
SUSE CVE-2026-92768
A flaw was found in cockpit-machines. This vulnerability allows a local attacker to expose sensitive Virtual Machine VM credentials, including plaintext passwords, by inspecting process command-line arguments during VM creation or installation. The cockpit-machines component passes password value...
SUSE CVE-2026-93566
A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can le...
EUVD-2026-83445
microsandbox: Secret values exposed in world-readable process arguments...
SUSE-SU-2026:23880-1 Security update for glib2
This update for glib2 fixes the following issue: - CVE-2026-15588: GDBusServer pre-authentication DoS via unbounded SASL line buffering bsc1272206...
SUSE-SU-2026:23928-1 Security update for glib2
This update for glib2 fixes the following issue: - CVE-2026-15588: GDBusServer pre-authentication DoS via unbounded SASL line buffering bsc1272206...
PT-2026-97036
Name of the Vulnerable Software and Affected Versions wlc versions prior to 2.0.1 Description The command-line client can send an unscoped API token to an attacker-controlled server when executed within an untrusted repository, pull request checkout, or a directory containing untrusted ancestor...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: gnupg2 (UTSA-2026-054045)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054045 advisory. GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints e.g., use of GPGME ar...
shell-quote: shell-quote: Arbitrary command execution via improper line terminator handling
A flaw was found in shell-quote. This vulnerability allows an attacker to achieve arbitrary command execution by supplying crafted input containing line break characters after a comment marker. When input is quoted, the comment marker comments out subsequent quotes until a newline is encountered,...
UBUNTU-CVE-2026-62866
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then reads the source at the exhausted index without an end-of-input check. ...
io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to control characters in the chunk-size line
A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can le...
io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to control characters in the chunk-size line
A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can le...
CVE-2026-77166
The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items...
CVE-2026-77166
CVE-2026-77166 affects the emoji field in a web application's page emoji update endpoint , where improper input validation allows an authenticated user to inject long text and line breaks , breaking the sidebar layout and potentially hiding other items. The vulnerability is rated CVSS 3.0 2.4 (Lo...
CVE-2026-77166
The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items...
EUVD-2026-83972
The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items...
CVE-2026-77166
The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items...
io.micrometer/micrometer-registry-statsd: io.micrometer/micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing
A flaw was found in Micrometer's StatsD and Logging meter registries. This vulnerability allows a remote attacker to inject line terminators into metric data, such as names or tag values, due to insufficient sanitization of untrusted input. Exploitation can lead to the spoofing of arbitrary...