47274 matches found
PT-2026-42366
goshs is Missing Write Protection for Parametric Data Values in github.com/patrickhener/goshs...
Unity Linux 20.1050e Security Update: kernel (UTSA-2026-021561)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-021561 advisory. In the Linux kernel, the following vulnerability has been resolved: vme: Fix error not catched in fakeinit In fakeinit, rootdeviceregister is possible to fail but it...
Extensions Component Bypass Security
The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to a flaw in data protection mechanisms. Exploiting this vulnerability allows an attacker to bypass existing security measures through a specially created HTML page...
Cisco Catalyst SD-WAN Manager Disclosure
The vulnerability of the user interface of the Cisco Catalyst SD-WAN Manager centralized system management system is related to insufficient protection of operational data. Exploiting this vulnerability can allow a malicious actor to disclose the protected information...
ServiceWorker Sandbox Bypass
The vulnerability of the ServiceWorker component in Google Chrome and Microsoft Edge is related to a violation of data protection mechanisms. Exploiting this vulnerability could allow an attacker to bypass the sandboxing protection mechanisms...
Unbreakable Enterprise kernel security update
5.15.0-320.202.8.4 - ptrace: slightly saner 'getdumpable' logic Linus Torvalds Orabug: 39391447 CVE-2026-46333 5.15.0-320.202.8.3 - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache Jeff Layton Orabug: 39362036 CVE-2026-31402 - net/sched: Only allow actct to bind to clsact/ingress qdiscs and...
CVE-2026-48131 - VPND IKE Fragment Reassembly - Heap Out-of-Bounds Write via Sequence Number Zero
Symptoms - The VPN service may mishandle an unexpected IKE fragment value received on the IKE port 500/UDP during the early stage of a connection attempt. This can cause the service to terminate unexpectedly, resulting in denial of service temporary disruption of VPN-related functionality. - The...
OpenMcdf: Uncatchable infinite loop in DirectoryTree.TryGetDirectoryEntry on crafted CFB directory cycle
Summary The BST name-lookup loop in DirectoryTree.TryGetDirectoryEntry OpenMcdf/DirectoryTree.cs:35-46 walks directory entries by repeatedly calling directories.TryGetSiblingchild, siblingType, validateColor. A crafted CFB file with cyclic Left/Right sibling links among directory entries -...
GHSA-HCF7-66RW-9F5R Turbo: Login callback CSRF/session fixation
Impact Turborepo's self-hosted login and SSO browser flows did not validate a CSRF state value on the localhost callback. While the CLI was waiting for authentication, a malicious web page could send a request to the local callback server with an attacker-controlled token. If accepted before the...
cisco-hypershield
Ansible Collection: stevefulme1.ciscohypershield Ansible Col...
CVE-2026-8966
Information disclosure in the IP Protection component. This vulnerability was fixed in Firefox 151 and Thunderbird 151...
UBUNTU-CVE-2026-8966
Information disclosure in the IP Protection component. This vulnerability was fixed in Firefox 151 and Thunderbird 151...
CVE-2026-8966
Information disclosure in the IP Protection component. This vulnerability was fixed in Firefox 151 and Thunderbird 151...
GHSA-HF67-5VVQ-FM3R Keycloak: Session fixation in OIDC login flow that can lead to account takeover
A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker could exploit this flaw by pre-creating an authentication session and tricking a victim into visiting a maliciously crafted link. By leveraging the /login-actions/restart endpoint—which...
Keycloak Protection API allows authenticated clients to access and modify resources owned by other Resource Servers
Keycloak's Authorization Services feature exposes a User-Managed Access Protection API that include an Insecure Direct Object Reference IDOR vulnerability in the Authorization Services Protection API endpoint. By knowing or obtaining a resource's unique identifier UUID belonging to another Resour...
GHSA-C739-F6XW-6PV2 Keycloak Protection API allows authenticated clients to access and modify resources owned by other Resource Servers
Keycloak's Authorization Services feature exposes a User-Managed Access Protection API that include an Insecure Direct Object Reference IDOR vulnerability in the Authorization Services Protection API endpoint. By knowing or obtaining a resource's unique identifier UUID belonging to another Resour...
CVE-2026-8966
Information disclosure in the IP Protection component. This vulnerability was fixed in Firefox 151 and Thunderbird 151...
CVE-2026-8966
The IP Protection component in Mozilla Firefox and Mozilla Thunderbird is vulnerable to an information disclosure flaw. This vulnerability allows a remote attacker to potentially gain access to confidential data . The issue has been addressed in Firefox 151 and Thunderbird 151 . No specific explo...
