144 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-61848
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing non-ASCII...
CVE-2026-61848
A flaw was found in crass. This vulnerability allows a remote attacker to cause a Denial of Service DoS through excessive CPU resource consumption. When parsing input containing non-ASCII characters, inefficiencies in tracking the positions of multi-byte characters result in disproportionately lo...
CVE-2026-61848
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing non-ASCII characters, inefficiencies in tracking the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled CSS...
CVE-2026-61848
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing non-ASCII characters, inefficiencies in tracking the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled CSS...
CVE-2026-61848
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing "non-ASCII characters", inefficiencies in tracking the positions of "multi-byte characters" result in superlinear parsing time. An attacker-controlled CS...
EUVD-2026-114324
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing non-ASCII characters, inefficiencies in tracking the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled CSS...
CVE-2026-61848: rgrove crass: Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing non-ASCII characters, inefficiencies in tracking the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled CSS...
BIT-NODE-MIN-2026-105483
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits １２７.0.0.1. tls.checkServerIdentity did not recognize such hosts as IP...
BIT-NODE-2026-105483
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits １２７.0.0.1. tls.checkServerIdentity did not recognize such hosts as IP...
ALPINE-CVE-2026-105483
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits １２７.0.0.1. tls.checkServerIdentity did not recognize such hosts as IP...
DEBIAN-CVE-2026-105483
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits １２７.0.0.1. tls.checkServerIdentity did not recognize such hosts as IP...
AZL-111038 CVE-2026-105483 affecting package nodejs for versions less than 24.22.1-0
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits １２７.0.0.1. tls.checkServerIdentity did not recognize such hosts as IP...
UBUNTU-CVE-2026-105483
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits １２７.0.0.1. tls.checkServerIdentity did not recognize such hosts as IP...
CVE-2026-105483
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits １２７.0.0.1. tls.checkServerIdentity did not recognize such hosts as IP...
CVE-2026-105483
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits １２７.0.0.1. tls.checkServerIdentity did not recognize such hosts as IP...
CVE-2026-105483
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits １２７.0.0.1. tls.checkServerIdentity did not recognize such hosts as IP...
CVE-2026-93633 Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet Characters
A CSS sanitization vulnerability in Zimbra Collaboration Suite ZCS allows an authenticated user with Briefcase access to publish a document that displays attacker-controlled content under the Zimbra origin. When processing a stylesheet containing non-ASCII characters, DefangFilter appends the fin...
CVE-2026-93633 Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet Characters
A CSS sanitization vulnerability in Zimbra Collaboration Suite ZCS allows an authenticated user with Briefcase access to publish a document that displays attacker-controlled content under the Zimbra origin. When processing a stylesheet containing non-ASCII characters, DefangFilter appends the fin...
CVE-2026-93633
Zimbra Collaboration Suite (ZCS) versions 10.1.16 and 10.1.20 are vulnerable to a CSS sanitization bypass within the Briefcase component. The root cause is that the DefangFilter appends the final ASCII segment of a stylesheet containing non-ASCII characters without proper sanitization. This allow...
CVE-2026-105483
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits １２７.0.0.1. tls.checkServerIdentity did not recognize such hosts as IP...