989755 matches found
DEBIAN-CVE-2026-18329
Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when a jsaccess handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker ca...
CVE-2026-18329
Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when a jsaccess handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker ca...
EUVD-2026-70138
Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when a jsaccess handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker ca...
CVE-2026-18329
NGINX JavaScript (njs) and QuickJS (qjs) engines contain an authentication/authorization bypass in the ngx_http_js_module . When a js_access handler performs asynchronous request body processing and an exception is thrown before an explicit denial is returned, the phase fails open , allowing unau...
CVE-2026-18329 NGINX ngx_http_js_module vulnerability
Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when a jsaccess handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker ca...
EUVD-2026-64334
NLTK: SSRF Fail-Open in validatenetworkurl via DNS Resolution Failure...
GHSA-3GQM-FCW5-W839 NLTK: SSRF Fail-Open in validate_network_url() via DNS Resolution Failure
There is an SSRF vulnerability in NLTK 3.9.4's network URL validation. The validatenetworkurl function in nltk/pathsec.py fails open when DNS resolution returns an error. The resolvehostname helper at lines 193-234 catches OSError and ValueError during socket.getaddrinfo and returns an empty list...
NLTK: SSRF Fail-Open in validate_network_url() via DNS Resolution Failure
There is an SSRF vulnerability in NLTK 3.9.4's network URL validation. The validatenetworkurl function in nltk/pathsec.py fails open when DNS resolution returns an error. The resolvehostname helper at lines 193-234 catches OSError and ValueError during socket.getaddrinfo and returns an empty list...
K000162599: NGINX ngx_http_js_module vulnerability CVE-2026-18329
Security Advisory Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when jsaccess handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An...
CVE-2026-53683
resetpassword.html parses query string parameters and uses the 'url' parameter as a redirection target window.location = url after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary...
DEBIAN-CVE-2026-53683
resetpassword.html parses query string parameters and uses the 'url' parameter as a redirection target window.location = url after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary...
CVE-2026-53683
resetpassword.html parses query string parameters and uses the 'url' parameter as a redirection target window.location = url after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary...
UBUNTU-CVE-2026-53683
resetpassword.html parses query string parameters and uses the 'url' parameter as a redirection target window.location = url after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary...
CVE-2026-53683 Freeipa: idm: idm/freeipa web ui - client-side open redirect in reset_password.html
resetpassword.html parses query string parameters and uses the 'url' parameter as a redirection target window.location = url after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary...
CVE-2026-53683 Freeipa: idm: idm/freeipa web ui - client-side open redirect in reset_password.html
resetpassword.html parses query string parameters and uses the 'url' parameter as a redirection target window.location = url after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary...
EUVD-2026-69892
resetpassword.html parses query string parameters and uses the 'url' parameter as a redirection target window.location = url after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary...
CVE-2026-53683
FreeIPA Web UI is affected by a client-side open redirect in reset_password.html. The file parses the url query string parameter and assigns it directly to window.location after the password-reset workflow completes, without validation or allowlisting. This allows an attacker to redirect users to...
CVE-2026-53683
resetpassword.html parses query string parameters and uses the 'url' parameter as a redirection target window.location = url after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary...
CVE-2026-53683
resetpassword.html parses query string parameters and uses the 'url' parameter as a redirection target window.location = url after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary...
[SECURITY] Fedora 44 Update: openvkl-2.0.2-1.fc44
Intel Open Volume Kernel Library Open VKL is a collection of high-performan ce volume computation kernels, developed at Intel. The target users of Open VKL are graphics application engineers who want to improve the performance of the ir volume rendering applications by leveraging Open VKL=E2=80=9...