26660 matches found
fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization
A flaw was found in fast-uri. This component improperly serializes the port component of a Uniform Resource Identifier URI without validating its content. A remote attacker can exploit this by crafting a malicious port value that injects authority delimiters. This manipulation can demote the...
Linux Distros Unpatched Vulnerability : CVE-2026-97435
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: dsa: sja1105: flower: reject cross-chip redirect dsaportfromnetdev may return a valid port from a different switch chip. Programming another chip's port...
Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: unbound (UTSA-2026-123924)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-123924 advisory. In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS...
PT-2026-98099
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the serial8250 register 8250 port function where uart-port.dev is conditionally copied from up-port.dev only if the latter is non-NULL. If both the existing uart slot...
AZL-105762 CVE-2026-66067 affecting package rabbitmq-server 3.13.7-9
RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The stream open handler calls only checkvhostaccess; it omits the node/vhost/user connection-limit checks that rabbitreader performs for AMQP. A developer %% FIXME comment at the cited line explicitly acknowledges th...
DEBIAN-CVE-2026-66067
RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The stream open handler calls only checkvhostaccess; it omits the node/vhost/user connection-limit checks that rabbitreader performs for AMQP. A developer %% FIXME comment at the cited line explicitly acknowledges th...
UBUNTU-CVE-2026-66067
RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The stream open handler calls only checkvhostaccess; it omits the node/vhost/user connection-limit checks that rabbitreader performs for AMQP. A developer %% FIXME comment at the cited line explicitly acknowledges th...
CVE-2026-66067
RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The stream open handler calls only checkvhostaccess; it omits the node/vhost/user connection-limit checks that rabbitreader performs for AMQP. A developer %% FIXME comment at the cited line explicitly acknowledges th...
CVE-2026-84721
A server-side request forgery flaw was found in the Ansible Automation Platform automation-controller email notification backend. The email backend passes the user-supplied SMTP host and port from a notification template directly to the SMTP client without validating that the target is not an...
CVE-2026-66067
RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The stream open handler calls only checkvhostaccess; it omits the node/vhost/user connection-limit checks that rabbitreader performs for AMQP. A developer %% FIXME comment at the cited line explicitly acknowledges th...
CVE-2026-84721
A server-side request forgery (SSRF) flaw exists in the Ansible Automation Platform automation-controller email notification backend. The backend fails to validate user-supplied SMTP host and port values from notification templates against internal, loopback, or reserved addresses. An authenticat...
EUVD-2026-85615
A server-side request forgery flaw was found in the Ansible Automation Platform automation-controller email notification backend. The email backend passes the user-supplied SMTP host and port from a notification template directly to the SMTP client without validating that the target is not an...
CVE-2026-84721 Automation-controller: automation-controller: email notification backend allows ssrf via user-controlled smtp host/port (internal port-scan oracle, smtp password exfil)
A server-side request forgery flaw was found in the Ansible Automation Platform automation-controller email notification backend. The email backend passes the user-supplied SMTP host and port from a notification template directly to the SMTP client without validating that the target is not an...
CVE-2026-84721
A server-side request forgery flaw was found in the Ansible Automation Platform automation-controller email notification backend. The email backend passes the user-supplied SMTP host and port from a notification template directly to the SMTP client without validating that the target is not an...
CVE-2026-50228 Electron DevTools Arbitrary Code Execution Vulnerability in NitroSense
An unauthenticated local attacker can connect to the Electron DevTools endpoint exposed by Acer NitroSense software versions up to and including 5.2.63 on localhost TCP port 9993. Because Chromium remote debugging is enabled in the production application, the attacker can execute JavaScript in th...
CVE-2026-50228
An unauthenticated local attacker can exploit a vulnerability in Acer NitroSense software (versions up to and including 5.2.63 ) by connecting to an exposed Electron DevTools endpoint on localhost TCP port 9993 . The root cause is that Chromium remote debugging remains enabled in the production a...
EUVD-2026-85152
An unauthenticated local attacker can connect to the Electron DevTools endpoint exposed by Acer NitroSense software versions up to and including 5.2.63 on localhost TCP port 9993. Because Chromium remote debugging is enabled in the production application, the attacker can execute JavaScript in th...
ROS-20260923-73-0082
The vulnerability of the arcserialprobe function in the drivers/tty/serial/arcuart.c file of the console TTY driver in the Linux kernel’s serial port module is related to improper memory release. Exploiting this vulnerability could allow an attacker to cause a service failure...
PT-2026-97549
Name of the Vulnerable Software and Affected Versions Ansible Automation Platform automation-controller affected versions not specified Description A server-side request forgery flaw exists in the email notification backend. The system passes the user-supplied SMTP host and port from a notificati...
MiracleLinux 8 : unbound-1.16.2-5.14.el8_10.2 (AXSA:2026-1894:13)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1894:13 advisory. unbound: Unbound: DNS cache poisoning via UDP source port predictability CVE-2026-50252 Tenable has extracted the preceding description block directly from t...