136900 matches found
PT-2026-63972
Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.2 Description A cross-site scripting issue exists in the siyuan:// protocol handler. When a link using the format siyuan://plugins/ references a plugin that is not installed, the application opens a custom tab and...
ROS-20260723-73-0038
The vulnerability in Chromium is related to errors in HTTP requests processing. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
CVE-2026-65606: Improper Neutralization of Input During Web Page Generation
SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/ link references a name that is not an installed plugin, the application opens a custom tab and inserts the link's icon parameter into the tab header via innerHTML without...
Oracle Enterprise Manager Metadata Plugin Full Control
The vulnerability of the Metadata Plugin component of the Oracle Enterprise Manager Base Platform relates to the lack of security measures taken to protect the structure of the web page. Exploiting this vulnerability could allow a malicious actor to gain full control over the application using th...
Oracle WebCenter Content Full Control
The vulnerability of the Content Server component of the Oracle WebCenter Content user interaction platform relates to the absence of authentication for a critical function. Exploiting this vulnerability could allow an attacker, operating remotely, to gain full control over the application using...
TencentOS Server 2: freerdp (TSSA-2026:0753)
The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0753 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...
Oracle Linux 8 : httpd:2.4 (ELSA-2026-42828)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-42828 advisory. - Resolves: RHEL-173558 - httpd:2.4/httpd: Apache HTTP Server modproxyajp: Arbitrary code execution via heap-based buffer overflow CVE-2026-28780 -...
Logto Identity Platform has authentication and authorization failures in core protocol handling
Overview The Logto platform contains multiple vulnerabilities affecting the identity‑processing pipeline. These flaws reduce the reliability of authentication and authorization decisions and may allow attackers to bypass account‑ownership checks, skip MFA, replay externally issued SSO responses, ...
TencentOS Server 2: freerdp (TSSA-2026:0752)
The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0752 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...
Oracle Linux 9 : kernel (ELSA-2026-43307)
The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-43307 advisory. - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels Antoine Tenart RHEL-179297 CVE-2026-46099 - fanotify: fix false positive on permission events...
Oracle Enterprise Manager Metadata Plugin Full Control
The vulnerability of the Metadata Plugin component of the Oracle Enterprise Manager Base Platform relates to the lack of security measures taken to protect the structure of the web page. Exploiting this vulnerability could allow a malicious actor to gain full control over the application using th...
TencentOS Server 2: freerdp (TSSA-2026:0754)
The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0754 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...
CVE-2026-16632 boazsegev facil.io WebSocket Frame websocket_parser.h websocket_on_protocol_error input validation
A flaw has been found in boazsegev facil.io up to 0.7.4. Affected is the function websocketonprotocolerror in the library lib/facil/http/parsers/websocketparser.h of the component WebSocket Frame Parser. This manipulation of the argument onmessage causes improper input validation. The attack can ...
CVE-2026-16632
CVE-2026-16632 affects boazsegev facil.io up to 0.7.4, specifically the WebSocket Frame Parser component. The vulnerability is in websocket_on_protocol_error (library file lib/facil/http/parsers/websocket_parser.h) where manipulation of the on_message argument leads to improper input validation. ...
Eclipse Jetty: HTTP Authority/Host mismatch
Summary Jetty currently accepts HTTP/2 and HTTP/3 requests where the regular Host header and the pseudo-header :authority do not match. As a result, the same request can carry two different host identities through Jetty: - logic based on HttpURI / Request.getServerNamerequest uses :authority -...
nerva v1.42.12
Nerva Nerva: Fast Service Fingerprinting CLI Features • Installation • Quick Start • Usage • Protocols • Library • Use Cases • Troubleshooting High-performance service fingerprinting written in Go. Identify 170+ network protocols across TCP, UDP, and SCTP transports with rich metadata extraction...
GHSA-7488-6R32-C95Q LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
Impact LiteLLM's MCP Streamable HTTP endpoint could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token. The MCP auth handler supported OAuth2 passthrough for upstream MCP servers, but the fallback path could replace failed LiteLLM key...
NPM: n8n: Shared Credential Header Leak via HTTP Request Pagination Expression
NPM: n8n: Shared Credential Header Leak via HTTP Request Pagination Expression vulnerability discovered by ? in WordPress Npm n8n versions 1.123.61...
GHSA-WH89-7897-X99H Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address
Security Vulnerability Report: HAProxy V1 Protocol CRLF Injection via AFUNIX Address in Netty 1. Vulnerability Summary | Field | Value | |-------|-------| | Product | Netty | | Version | 4.2.12.Final and all prior versions with codec-haproxy | | Component |...
Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address
Security Vulnerability Report: HAProxy V1 Protocol CRLF Injection via AFUNIX Address in Netty 1. Vulnerability Summary | Field | Value | |-------|-------| | Product | Netty | | Version | 4.2.12.Final and all prior versions with codec-haproxy | | Component |...