367527 matches found
Go Cryptography Data Compromise
The vulnerability of the Go Cryptography library is related to errors in the certificate authentication process. Exploiting this vulnerability could allow an attacker to gain unauthorized access and influence the integrity of the protected information...
CVE-2026-95609: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Stored XSS.This issue affects Media LIbrary Assistant: from n/a through 3.41...
Go Cryptography Library DoS
The vulnerability of the Go Cryptography library is related to type conversion errors. Exploiting this vulnerability could allow a malicious actor to cause service failures...
azureml-acft-image-components (>=0.0.7, <=0.0.45), azureml-evaluate-mlflow (>=0.0.0, <=0.0.91) +14 more potentially affected by unknown CVE via mlflow (>=3.12.0, <=3.16.1)
mlflow PYPI version =3.12.0, =0.0.7, =0.0.0, =0.9.1, =0.6.0, =0.2.9, =1.4.0, =0.0.4, =1.0.8, =0.1.0, =0.1.0, =0.1.3 and more Source cves: unknown CVE Source advisory: MEND:WS-2026-0135...
OPENSUSE-SU-2026:12093-1 go1.26-1.26.9-1.1 on GA media
These are all security issues fixed in the go1.26-1.26.9-1.1 package on the GA media of openSUSE Tumbleweed...
Go Yaml File Processing Heap Buffer Overflow DoS
The vulnerability of the Go Yaml file processing library is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...
fastjson
fastjson Fastjson es una librería de Java que se puede usar para convertir objetos Java a su representación JSON. También se puede usar para convertir una cadena JSON en un objeto Java equivalente. Fastjson puede trabajar con objetos Java arbitrarios, incluyendo objetos preexistentes de los cuale...
DEBIAN-CVE-2026-97031
Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector a...
DEBIAN-CVE-2026-97030
A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped...
DEBIAN-CVE-2026-94439
When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...
DEBIAN-CVE-2026-78669
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...
DEBIAN-CVE-2026-94440
Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes...
AZL-107673 CVE-2026-78660 affecting package kubevirt 1.8.4-2
Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...
DEBIAN-CVE-2026-78660
Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...
AZL-107054 CVE-2026-78660 affecting package cri-o 1.30.1-1
Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...
AZL-107592 CVE-2026-78663 affecting package kata-containers-cc 3.15.0.aks0-21
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...
AZL-107066 CVE-2026-78663 affecting package cri-o 1.30.1-1
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...
AZL-107165 CVE-2026-78659 affecting package azurelinux-image-tools 1.6.0-3
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...
AZL-107679 CVE-2026-78663 affecting package kured 1.15.0-6
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...
AZL-107781 CVE-2026-78660 affecting package opa 0.63.0-5
Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...