25405 matches found
CVE-2026-67865
S2OPC 1.7.3 contains an out-of-bounds read in RepublishResponse handling. This allows a remote attacker to cause a denial of service...
CVE-2026-67865
S2OPC 1.7.3 contains an out-of-bounds read in RepublishResponse handling. This allows a remote attacker to cause a denial of service...
PT-2026-68992
Summary The shared HTTP CONNECT helper parses a proxy response with http.ReadResponse over an unrestricted buffered reader. The production helper accepted a valid response containing a 2 MiB header in three consecutive runs. A malicious or compromised configured proxy, or an active on-path actor...
CVE-2026-67865
S2OPC 1.7.3 contains an out-of-bounds read in RepublishResponse handling. This allows a remote attacker to cause a denial of service...
PT-2026-68169
Name of the Vulnerable Software and Affected Versions Red Hat Build of Keycloak affected versions not specified Description A flaw exists in the SAML metadata import functionality of the keycloak-services component, which serves as the core engine for identity brokering. When identity provider...
CVE-2026-54876
Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response that contains no single response entries. Impact summary: An attacker can leak an attacker-tunable amount of memory per TLS handshake in a victim clien...
CVE-2026-67865
The software S2OPC version 1.7.3 is vulnerable to an out-of-bounds read during the handling of RepublishResponse . This security flaw could allow a remote attacker to trigger a denial of service (DoS) . While the vulnerability is confirmed across multiple security databases, specific remediation ...
OpenSSL 4.0.0 < 4.0.2 Multiple Vulnerabilities
The version of OpenSSL installed on the remote host is prior to 4.0.2. It is, therefore, affected by multiple vulnerabilities as referenced in the 4.0.2 advisory. - Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the...
Ghost: Member existence leak via magic link sign-in response
Impact A discrepancy in responses from the members signin endpoints made it possible for an unauthenticated attacker to determine whether a given email address belongs to a registered member of a Ghost site. Vulnerable versions This vulnerability is present in Ghost from v5.18.0 up to v6.21.0...
GHSA-CHGM-3698-JM42 Ghost: Member existence leak via magic link sign-in response
Impact A discrepancy in responses from the members signin endpoints made it possible for an unauthenticated attacker to determine whether a given email address belongs to a registered member of a Ghost site. Vulnerable versions This vulnerability is present in Ghost from v5.18.0 up to v6.21.0...
NPM: Ghost: Member existence leak via magic link sign-in response
NPM: Ghost: Member existence leak via magic link sign-in response vulnerability discovered by ? in WordPress Npm ghost versions = 5.18.0, 6.21.1...
CVE-2026-16728
A flaw was found in undici. A malicious or faulty upstream server could send a partial response with incorrect length information. When undici's retry interceptor processes this, it may create a response body with a length that does not match the original Content-Length header. This can lead to...
Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs
Summary Open WebUI fetches user-supplied URLs on the server for RAG URL ingestion, URL-to-markdown conversion and web-search content retrieval, and decides whether a destination is allowed by asking whether its IP address is globally routable. That test operates on the literal IPv6 address and do...
eda-server: ExternalEventStreamViewSet trusts Subject header without validation and leaks expected DN
A flaw was found in the Event-Driven Ansible EDA server. The ExternalEventStreamViewSet uses permissive access controls permissionclasses=AllowAny, authenticationclasses= and relies solely on the Subject HTTP header value for mTLS authentication without verifying that the header originated from a...
net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...
Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history
Summary The GET /api/v1/upsert-history endpoint returns the entire server-wide upsert history response size 100MB instead of being scoped to the requesting user/tenant/workspace. The response includes sensitive configuration data e.g., Vector Store settings such as Qdrant Server URL and collectio...
CVE-2026-25288
Transient DOS when processing a short target wake time channel usage response frame with insufficient packet size...
Malicious code in picasso.js (npm)
npm/picasso.js is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by the...
