12826 matches found
CVE-2026-59327
Spring Tools for Eclipse stores the Spring Boot DevTools remote secret spring.devtools.remote.secret as a plain string attribute on the "Spring Boot DevTools Client" launch configuration. Eclipse persists launch configuration attributes as cleartext XML, either to workspace metadata or, if the us...
EUVD-2026-50974
Spring Tools for Eclipse stores the Spring Boot DevTools remote secret spring.devtools.remote.secret as a plain string attribute on the "Spring Boot DevTools Client" launch configuration. Eclipse persists launch configuration attributes as cleartext XML, either to workspace metadata or, if the us...
CVE-2026-47882
When enabling Spring Boot DevTools support for a remote application target for example a Docker container or Cloud Foundry app from the Spring Tools Boot Dashboard, Spring Tools generates a shared secret that authenticates DevTools remote-restart uploads to the deployed application. This secret w...
CVE-2026-16526
A flaw in the PCP linuxsockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root. Mitigation To mitigate this vulnerability, ensure that the linuxsockets PMDA is not configured to...
undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives
A flaw was found in undici. This vulnerability allows for cross-user information disclosure when malformed Cache-Control private directives cause private response bodies and headers, such as Set-Cookie data, to be stored in a shared cache and subsequently exposed to other users. Additionally, a...
PT-2026-66565
IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to access another user's private vector documents by creating their own flow with matching Chroma persist directory and collection name values. The attacker receives exact victim content in their workflow output despite having no...
The vulnerability of the Win32k.sys component in Windows operating systems, which allows a hacker to increase their privileges
The vulnerability of the Win32k.sys component in Windows operating systems is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to gain increased privileges...
The vulnerability of the change_page_attr() function in the arch/powerpc/mm/pageattr.c module, which is part of the PowerPC platform support in the Linux operating system, allows a hacker to cause a service failure.
The vulnerability of the changepageattr function in the arch/powerpc/mm/pageattr.c module of the PowerPC platform in the Linux operating system is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cause a service failure...
CVE-2026-51290
...
Linux Distros Unpatched Vulnerability : CVE-2026-14643
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no- cache or private Cache-Control directive. In undici...
CVE-2026-51290
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
PT-2026-66522
SQLite 3.41 has a use-after-free vulnerability in the shared cache lock management logic of the btree module. The program frees a BtLock structure without removing the node from the linked list. Subsequent linked list traversal accesses the released memory, which can lead to denial of service and...
EUVD-2026-51253
SQLite 3.41 has a use-after-free vulnerability in the shared cache lock management logic of the btree module. The program frees a BtLock structure without removing the node from the linked list. Subsequent linked list traversal accesses the released memory, which can lead to denial of service and...
CVE-2026-51290
CVE-2026-51290 entry is rejected/not used and does not represent an active vulnerability.
The vulnerabilities of the functions l2cap_register_user() and l2cap_unregister_user() in the net/bluetooth/l2cap_core.c module of the Linux kernel’s Bluetooth subsystem allow a malicious actor to cause service failures.
The vulnerability of the functions l2capregisteruser and l2capunregisteruser in the net/bluetooth/l2capcore.c module of the Linux kernel’s Bluetooth subsystem is related to synchronization errors when using shared resources. Exploiting this vulnerability could allow a attacker to cause service...
Interpretation Conflict
Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Interpretation Conflict via the parseCacheControlHeader function in lib/util/cache.js and the cache interceptor. An attacker can cause a shared cached response containing...
Interpretation Conflict
Overview org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Interpretation Conflict via the parseCacheControlHeader function in lib/util/cache.js and the cache interceptor. An attacker can cause a shared cached...
CVE-2026-14643
undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directive or stores a field name with literal...
DEBIAN-CVE-2026-14643
undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directive or stores a field name with literal...