21865 matches found
CVE-2026-87636
Type confusion in XML in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...
RockyLinux 9 : valkey (RLSA-2026:64807)
The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:64807 advisory. redis: Redis: Remote Code Execution via specially crafted RESTORE payload CVE-2026-66373 valkey: Valkey: Remote code execution via use-after-free in...
The vulnerability of the JSON processing library and stream-json, related to algorithmic complexity, allows attackers to cause service failures.
The vulnerability of the JSON processing library and stream-json is related to algorithmic complexity. Exploiting this vulnerability could allow an attacker to cause a service failure...
RockyLinux 10 : valkey (RLSA-2026:64796)
The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:64796 advisory. redis: Redis: Remote Code Execution via specially crafted RESTORE payload CVE-2026-66373 valkey: Valkey: Remote code execution via use-after-free in...
ROS-20260909-73-0176
The vulnerability of the Skia component in the Google Chrome web browser is related to errors in HTTP requests processing. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...
The vulnerability of the ovpn_tcp_close() function in the drivers/net/ovpn/tcp.c module of the Linux kernel’s network device driver allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the ovpntcpclose function in the drivers/net/ovpn/tcp.c module of the Linux kernel’s network device driver is related to a race condition in the signal processing routine. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...
Palo Alto Networks PAN-OS 10.2.x / 11.1.x / 11.2.x / 12.1.x / 12.2.x Vulnerability
The version of Palo Alto Networks PAN-OS running on the remote host is a vulnerable version of 10.2.x, 11.1.x, 11.2.x, 12.1.x, or 12.2.x. It is, therefore, affected by a vulnerability. A buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS software enable...
SAP NetWeaver Memory Corruption (3747649)
The version of the SAP NetWeaver kernel detected on the remote host is affected by a memory corruption vulnerability as referenced in SAP Security Note 3747649: - A memory safety vulnerability exists in the Extended Passport Protocol EPP processing library. Under specific conditions, an...
ROS-20260909-73-0174
The vulnerability of the Skia component in the Google Chrome web browser is related to errors in HTTP requests processing. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...
ROS-20260909-73-0156
The vulnerability of the PDFium component in Google Chrome and Microsoft Edge browsers is related to errors in HTTP requests processing. Exploiting this vulnerability can allow an attacker to cause service interruptions using a specially created font file...
ROS-20260909-73-0074
The vulnerability of the Skia component in Google Chrome and Microsoft Edge is related to errors in HTTP request processing. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...
The vulnerability of the _get_outline() function in the pypdf/_doc_common.py library of the Python library for working with PDF files, PyPDF, allows a attacker to cause a service failure.
The vulnerability of the getoutline function in the pypdf/doccommon.py library of the Python PDF handling library PyPDF is related to asymmetric resource consumption. Exploiting this vulnerability could allow an attacker to cause a service failure...
AlmaLinux 9 : valkey (ALSA-2026:64807)
The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:64807 advisory. redis: Redis: Remote Code Execution via specially crafted RESTORE payload CVE-2026-66373 valkey: Valkey: Remote code execution via use-after-free in stre...
CVE-2026-86420
A flaw was found in ImageMagick. This vulnerability occurs when the software fails to correctly manage its memory budget during certain image processing operations. Repeatedly triggering these failures can lead to the exhaustion of the process's memory, causing the application to become...
CVE-2026-85458
A flaw was found in Xpdf. This vulnerability, a divide-by-zero error, occurs when the application processes a Type 3 font glyph that has a zero height. A local attacker could exploit this condition to trigger a crash, leading to a denial of service and making the application unavailable. Mitigati...
sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545
Impact A number of vulnerabilities, two rated as "Critical" severity using CVSSv3, have been discovered and fixed in the upstream libheif dependency. These can lead to possible remote code execution RCE on glibc-based Linux when run under certain conditions. The attack vector for these claims to ...
Security Bulletin: IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
Summary IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities. Vulnerability Details CVEID:CVE-2026-16190 DESCRIPTION: IBM WebSphere Application Server is affected by an authorization bypass vulnerability. CWE:CWE-862: Missing Authorization CVSS...
GHSA-C7Q8-3CH8-VQPV xmldom: Processing Instruction Target Injection Bypasses requireWellFormed
Summary Document.createProcessingInstruction in @xmldom/xmldom performs no validation on the target parameter. The requireWellFormed: true serializer option validates only for : in the target and a case-insensitive xml prefix, but does not check for characters. A in the target breaks the processi...
xmldom: Processing Instruction Target Injection Bypasses requireWellFormed
Summary Document.createProcessingInstruction in @xmldom/xmldom performs no validation on the target parameter. The requireWellFormed: true serializer option validates only for : in the target and a case-insensitive xml prefix, but does not check for characters. A in the target breaks the processi...
