157817 matches found
CVE-2026-103958 Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS
Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the credentials of the application's own container role and to read responses from arbitrary internal network locations, via a crafte...
CVE-2026-103958
Loom for AWS versions before 1.7.0 are vulnerable to a Server-side request forgery (SSRF) in the tool server and remote agent connection handling. An authenticated remote user can exploit this by supplying a crafted connection address during the registration, updating, or testing of a tool server...
CVE-2026-103958 Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS
Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the credentials of the application's own container role and to read responses from arbitrary internal network locations, via a crafte...
EUVD-2026-91771
Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network...
CVE-2026-96940
A weak authorization vulnerability in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network. The vulnerability is confirmed and is addressed in several security updates, including KB5129955 (Subscription Edition RTM), KB5129956 (2019 CU15), KB5129957 (201...
CVE-2026-83663
A flaw was found in Apache Thrift. A remote attacker can cause a Denial of Service DoS by sending specially crafted network frames with zero payload bytes to an affected Go service. When processing these empty frames, the transport recursively calls its read function rather than iterating in a...
Microsoft Exchange Server Elevation of Privilege Vulnerability
Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network...
EUVD-2026-91450
YesWiki before 4.6.7 contains a blind server-side request forgery vulnerability that allows unauthenticated attackers to make arbitrary server-side requests via the idtypeannonce parameter of /api/entries/bazarlist. Because isValidURL always returns true, attackers can supply internal URLs fetche...
CVE-2026-104435
Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 consensus rule, accepting V5 transparent inputs signed with SIGHASHSINGLE that lack a corresponding output. Attackers can broadcast crafted V5 transactions with more inputs than outputs that Zebra accepts but zcashd rejects,...
EUVD-2026-91445
Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 consensus rule, accepting V5 transparent inputs signed with SIGHASHSINGLE that lack a corresponding output. Attackers can broadcast crafted V5 transactions with more inputs than outputs that Zebra accepts but zcashd rejects,...
Out-of-bounds Write
Overview Affected versions of this package are vulnerable to Out-of-bounds Write through the THeaderTransport. An attacker can cause an application crash by sending specially crafted network traffic that triggers an out-of-bounds memory write. Remediation Upgrade thrift to version 0.25.0 or highe...
SUSE-SU-2026:4417-1 Security update for helm
This update for helm fixes the following issues: - CVE-2026-85731: oras.land/oras-go/v2: arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction bsc1281104. - CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows...
USN-8864-1 linux, linux-aws, linux-fips, linux-kvm, linux-lts-xenial vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Network file system NFS server daemon; - IPv6 networking; - Netfilter; CVE-2025-38724, CVE-2026-53131, CVE-2026-532...
USN-8864-1: Linux kernel vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Network file system NFS server daemon; - IPv6 networking; - Netfilter; CVE-2025-38724, CVE-2026-53131, CVE-2026-532...
USN-8818-6: Linux kernel (FIPS) vulnerabilities
It was discovered that some Arm processors could complete a broadcast translation lookaside buffer TLB invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been...
Zoho manageengine - Cross-Site Scripting
Zoho manageengine is vulnerable to reflected cross-site scripting. This impacts Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 via the...
CVE-2026-63045
A flaw was found in httpd. When configured as a forward proxy using the modproxyftp module, the server improperly validates the network address returned in a File Transfer Protocol FTP passive mode PASV response. A malicious FTP server can exploit this flaw by returning a crafted reply, forcing t...
EUVD-2009-5122
Belkin Bulldog Plus version 4.0.2 build 1219 contains a stack-based buffer overflow vulnerability in its web service authentication handler. When a specially crafted HTTP request is sent with an oversized Authorization header, the application fails to properly validate the input length before...
CVE-2026-103098
The GV-Eye software is vulnerable to sensitive information exposure due to the transmission of a sensitive key within the URL query parameter over an unencrypted HTTP connection. Because the request is sent in plaintext rather than via HTTPS, an attacker capable of monitoring network traffic can ...
PT-2026-104419
Name of the Vulnerable Software and Affected Versions Loom for AWS versions prior to 1.7.0 Description An authenticated remote user can perform a Server-side request forgery SSRF through the tool server and remote agent connection handling. By providing a crafted connection address during the...