41233 matches found
CVE-2026-114609
fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTPS URLs and raw local paths supplied through FPDF.image, FPDF.writehtml HTML values, SVG or xlink:href values, and template image fields. This can cause outbou...
CVE-2026-114609
The fpdf2 PDF creation library for Python (prior to version 2.8.8 ) contains a vulnerability where the shared image loader automatically dereferences attacker-controlled HTTP(S) URLs and raw local paths. This occurs when processing inputs from FPDF.image() , FPDF.write_html() (HTML values), SVG ...
CVE-2026-114609
fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTPS URLs and raw local paths supplied through FPDF.image, FPDF.writehtml HTML values, SVG or xlink:href values, and template image fields. This can cause outbou...
CVE-2026-114609 fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content
fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTPS URLs and raw local paths supplied through FPDF.image, FPDF.writehtml HTML values, SVG or xlink:href values, and template image fields. This can cause outbou...
CVE-2026-114609
fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTPS URLs and raw local paths supplied through FPDF.image, FPDF.writehtml HTML values, SVG or xlink:href values, and template image fields. This can cause outbou...
CVE-2026-114609 fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content
fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTPS URLs and raw local paths supplied through FPDF.image, FPDF.writehtml HTML values, SVG or xlink:href values, and template image fields. This can cause outbou...
CVE-2026-113582
UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera. This issue affects Apache Abdera: all versions. Apache Abdera ...
CVE-2026-113582
UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera. This issue affects Apache Abdera: all versions. Apache Abdera ...
CVE-2026-113582 Apache Abdera: XML external entity expansion in Atom document parsing
UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera. This issue affects Apache Abdera: all versions. Apache Abdera ...
EUVD-2026-108166
UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera. This issue affects Apache Abdera: all versions. Apache Abdera ...
CVE-2026-113582
This vulnerability affects all versions of Apache Abdera due to improper restriction of XML external entity references during Atom document parsing. An attacker could potentially access sensitive data or trigger server-side requests by providing attacker-controlled XML. Because Apache Abdera is r...
USN-8952-1: Tornado vulnerabilities
It was discovered that Tornado did not properly handle certain HTTP requests and network inputs. An attacker could possibly use these issues to cause a denial of service, expose sensitive information, or bypass access controls. CVE-2023-54397, CVE-2024-14029, CVE-2026-91990, CVE-2026-91992,...
USN-8952-1 python-tornado vulnerabilities
It was discovered that Tornado did not properly handle certain HTTP requests and network inputs. An attacker could possibly use these issues to cause a denial of service, expose sensitive information, or bypass access controls. CVE-2023-54397, CVE-2024-14029, CVE-2026-91990, CVE-2026-91992,...
PHP2Shell
PHP2Shell CVE-2026-109618 PHP 8.5.4 may allow for a buffer...
BIT-GRAFANA-2026-9703 Viewer role can create, modify and delete Loki alerting rules
Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki rules API /loki/api/v1/rules, allowing...
libkcapi: Memory corruption via uncanceled AIO requests on error in libkcapi's one-shot AIO path
Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers...
CLSA-2026-1790852342 squid: Fix of 4 CVEs
Bump release to sort above Oracle Linux 7 squid-3.5.20-17.0.11.el79.13 - CVE-2025-62168: complete fix: also redact credentials in the %W mailto body, from Oracle 17.0.9 - Deny URN requests in the default squid.conf upstream workaround, from Oracle 17.0.7...
CLSA-2026-1790851347 squid: Fix of 5 CVEs
Bump release to sort above Oracle Linux 7 squid-3.5.20-17.0.11.el79.13 - CVE-2025-62168: complete fix: also redact credentials in the %W mailto body, from Oracle 17.0.9 - Deny URN requests in the default squid.conf upstream workaround, from Oracle 17.0.7...
EUVD-2026-107654
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could trick a user that holds a role with the editfederatedproviders capability into turning off all federated search providers. Successful exploitation could temporarily prevent federated searches fr...
Linux Distros Unpatched Vulnerability : CVE-2026-111809
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer- Encoding. This issue affects Apache Traffic Server: from...