12732 matches found
io.netty/netty-codec-http: Netty: Protocol version confusion in netty-codec-http (WebSocket)
A flaw was found in netty-codec-http. The WebSocket handshaker in this component fails to properly validate protocol version information during the WebSocket upgrade process. A remote attacker can exploit this vulnerability by manipulating the WebSocket handshake, leading to a bypass of security...
io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header
A flaw was found in Netty, a network application framework. A remote attacker can bypass security controls in the CorsHandler component by sending a specially crafted request with a null origin header. This bypasses the intended access restrictions, allowing unauthorized requests to reach the...
PT-2026-66262
Inappropriate implementation in Parser in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass content security policy via a crafted HTML page. Chromium security severity: Low...
Apache Traffic Server encryption vulnerability
Apache Traffic Server is a high-performance HTTP proxy server open source from the Apache Foundation in the United States. There is an encryption-related vulnerability in Apache Traffic Server. This vulnerability stems from the certifier plugin generating certificates based on the client SNI...
jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution
A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the system to process untrusted data, which may lead to the...
EUVD-2026-38084
Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities...
CVE-2026-18174
@fastify/forwarded resolves client addresses from the X-Forwarded-For header. In versions before 3.0.2, when the header contains two or more comma separated entries, the parser trims only space characters and does not strip horizontal tabs, even though RFC 7230 defines optional whitespace as both...
CVE-2026-64375
A flaw was found in the Linux kernel's proc filesystem. A local attacker with low privileges could exploit a race condition within the ptracemayaccess function when handling file descriptor links. This vulnerability arises because the system performs multiple task lookups without proper...
CVE-2026-18207
CVE-2026-18207 : Keycloak-services suffers a group-name based membership check bug in the client policy enforcement, allowing an attacker with client-management privileges to bypass security hardening by joining a differently-nested group with the same name. This can enable registering or updatin...
CVE-2026-18207
A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name instead of a unique identifier. An attacker with client management privileges could bypass security policies by joining a group with a matching name in a...
Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities
Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-0994 DESCRIPTION: A denial-of-service DoS vulnerability exists in google.protobuf.jsonformat.ParseDict in Python, where the maxrecursiondepth limit can be bypassed when...
KLA91183 Multiple vulnerabilities in Google Chrome
Multiple vulnerabilities were found in Google Chrome. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. A remote co...
CVE-2026-59897
A flaw was found in Hono, a web application framework. The AWS API Gateway v1 adapter incorrectly de-duplicates repeated request header values using a substring comparison, rather than an exact match. This can lead to incomplete data being received by middleware or application logic that relies o...
httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass
A vulnerability has been identified in the Apache HTTP Server. If the server is configured to connect to a malicious or compromised backend server, an attacker could exploit this flaw to bypass security controls or run unauthorized code on the system...
Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is affected by a security bypass vulnerability
Summary IBM WebSphere Application Server shipped with Jazz for Service Management JazzSM is affected by a security bypass vulnerability CVE-2026-10842 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products|...
CVE-2026-17524
Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the extraction process. An attacker can bypass security checks designed to prevent directory traversal. The intended security function, isOutsideTargetFolder, on...
EUVD-2026-49687
Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the extraction process. An attacker can bypass security checks designed to prevent directory traversal. The intended security function, isOutsideTargetFolder, on...
BIT-DOTNET-2026-50528 .NET Security Feature Bypass Vulnerability
Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network...