7862 matches found
CVE-2025-13394: Cross-Site Request Forgery (CSRF)
The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery CSRF attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechani...
The vulnerability of the acpi_processor_errata_piix4() function in the drivers/acpi/acpi_processor.c driver of the ACPI driver module for the Linux kernel allows a attacker to cause a system failure.
The vulnerability of the acpiprocessorerratapiix4 function in the drivers/acpi/acpiprocessor.c file of the ACPI driver for the Linux kernel is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a system failure...
Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation
Impact The internal island renderer endpoint /nuxtisland/... decodes and hashes attacker-controlled request input before it validates the URL-resident hash. An unauthenticated POST /nuxtisland/.json with a large JSON body for example 4.6 MB / 150k keys is fully read, destr-parsed, and run through...
EUVD-2026-53658
Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, the internal island renderer endpoint /nuxtisland/... decodes and hashes attacker-controlled JSON body input with destr and ohash before validating the URL-resident hash. An unauthenticated POST...
CVE-2026-15996
The CVE describes a denial-of-service flaw in GitHub Enterprise Server where unauthenticated attackers could trigger excessive CPU usage and exhaust request-handling worker processes by sending a crafted form-encoded HTTP POST containing deeply nested parameters. Because parameter parsing occurre...
CVE-2026-68077 Apache Qpid Broker-J: Unbounded disposition range handling can lead to denial of service
An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial of service. This issue affects Apache Qpid Broker-J: through 10.0.1. Users are recommended to upgrade to version 10.1.0, which fixes the...
openjdk: Improve certification checking (Oracle CPU 2026-07)
A flaw was found in OpenJDK. OpenJDK can apply two different security meanings to the same wildcard dNSName SAN across certificate policy enforcement and hostname verification. During path validation, DNSName.constrains compares .foo.com and secret.foo.com literally and returns NAMESAMETYPE, so...
CVE-2026-24084
Technical details about CVE-2026-24084 are not publicly available in the provided documents. Monitor for updates from the listed sources; current entries only state a weak configuration related to UE security capability replay verification.
CVE-2026-24084 Insecure Security Identifier Mechanism in Multi-Mode Call Processor
Weak configuration when UE does not verify the consistency of its additional security capabilities with the replayed capabilities...
CVE-2026-24084 Insecure Security Identifier Mechanism in Multi-Mode Call Processor
Weak configuration when UE does not verify the consistency of its additional security capabilities with the replayed capabilities...
golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip
A flaw was found in the archive/zip package in the Go standard library. A super-linear file name indexing algorithm is used in the first time a file in an archive is opened. A crafted zip archive containing a specific arrangement of file names can cause an excessive CPU and memory consumption. A ...
CVE-2026-64562
In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Hide shadow VMCS right after VMCLEAR freenested frees the shadow VMCS while vmcs01 still points to it. But because it is asynchronous with respect to loadedvmcsclear, the vCPU might migrate before the pointer is cleare...
EUVD-2026-52512
An issue in the HSMonitorApplications component of NASA cFS v7.0.1 allows attackers to force the processor to reset via supplying a crafted HS.AppMonTbl entry...
Linux Distros Unpatched Vulnerability : CVE-2026-18401
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000...
CVE-2026-67969
An issue in the HSMonitorApplications component of NASA cFS v7.0.1 allows attackers to force the processor to reset via supplying a crafted HS.AppMonTbl entry...
Rapid7 Analysis: KindaRails2Shell (CVE-2026-66066)
Overview On July 29, 2026, the Ruby on Rails project published a security advisory for CVE-2026-66066, an arbitrary file read in Active Storage applications that use the Vips image processor with untrusted uploads. The affected Active Storage ranges are = 8.0, = 8.1, 8.1.3.1. Vips is the default...
Allocation of Resources Without Limits or Throttling
Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the engineLoad method of BcFKSKeyStoreSpi, which reads HMAC PBKDF2 or scrypt cost parameters from a keystore's integrity structures and runs key derivation before MAC verification,...
PT-2026-67536
Name of the Vulnerable Software and Affected Versions NASA cFS version 7.0.1 Description An issue exists in the HS MonitorApplications function of the Health and Safety HS component. An attacker can force a processor reset by providing a specially crafted HS.AppMon Tbl entry. Recommendations At t...
CVE-2026-67969
An issue in the HS_MonitorApplications() component of NASA cFS v7.0.1 allows attackers to force a processor reset. The vulnerability is triggered by supplying a crafted HS.AppMon_Tbl entry . No specific remediation, exploit links, or MITRE ATT&CK IDs are provided in the documents.