CVE-2026-84649

In Stapler 1839.ved17667baeb5 through 2107.v8dfcbe8ed317 both inclusive, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.447 through 2.579 both inclusive, LTS 2.452.1 through 2.568.2 both inclusive, an HTTP endpoint serving dynamically generated JavaScript resources embeds the user's...

DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute

A flaw was found in the DBI component for Perl. This vulnerability allows an attacker to inject and execute arbitrary code by manipulating the Profile attribute of a DBI handle. When a string is assigned to this attribute, the component processes it without proper validation, enabling the executi...

EUVD-2026-68765

Livewire DOM-based cross-site scripting during client-side state handling...

kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath

A flaw was found in the Linux kernel's CIFS Common Internet File System client. When the cifssanitizeprepath function processes specially crafted input, such as an empty string or a string containing only delimiters, it can attempt to read data beyond its allocated memory buffer. This out-of-boun...

CVE-2026-59276

Several components in Spring Security compare security-sensitive values using standard string equality String.equals rather than a constant-time comparison. Because String.equals returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the...

CVE-2026-82562

A flaw was found in qs. An unauthenticated attacker can exploit this by sending a specially crafted query string to an application using qs.parse with specific non-default settings comma: true and throwOnLimitExceeded: true. This bypasses a configured array limit, causing the parser to allocate a...

CVE-2026-53683

resetpassword.html parses query string parameters and uses the 'url' parameter as a redirection target window.location = url after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary...

CVE-2026-53683

resetpassword.html parses query string parameters and uses the 'url' parameter as a redirection target window.location = url after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary...

qs: qs: Denial of Service via array limit bypass in query string parsing

A flaw was found in qs. An unauthenticated attacker can exploit this by sending a specially crafted query string to an application using qs.parse with specific non-default settings comma: true and throwOnLimitExceeded: true. This bypasses a configured array limit, causing the parser to allocate a...

CVE-2026-84376: Partial String Comparison

Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured non-root base path from request pathnames using a string-prefix check without verifying a path-segment boundary. With base "/app", a request to "/appX/admin" resolved internally to the protected...

perl-DBI security update

1.641-2 - Fix stack overflow and buffer overflow in DBI.xs CVE-2026-9698 Resolves: RHEL-211160 - Fix heap overflow in SQL preparsing can lead to denial of service or arbitrary code execution CVE-2026-10879 Resolves: RHEL-227962 - Fix unsafe string eval in DBI::Profile CVE-2026-14380 Resolves:...

CVE-2026-73782

A format string vulnerability exists in the command line interface of AOS-CX that could lead to unauthenticated remote code execution. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system...

CVE-2026-73782 Unauthenticated Format String Vulnerability leads to Remote Code Execution in AOS-CX

A format string vulnerability exists in the command line interface of AOS-CX that could lead to unauthenticated remote code execution. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system...

EUVD-2026-69645

A format string vulnerability exists in the command line interface of AOS-CX that could lead to unauthenticated remote code execution. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system...

CVE-2026-73782

CVE-2026-73782 is an unauthenticated format string vulnerability in the command line interface of HPE AOS-CX . Successful exploitation allows execution of arbitrary code as a privileged user on the underlying operating system, leading to full compromise of confidentiality, integrity, and availabi...

CVE-2026-73782 Unauthenticated Format String Vulnerability leads to Remote Code Execution in AOS-CX

A format string vulnerability exists in the command line interface of AOS-CX that could lead to unauthenticated remote code execution. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system...

CVE-2026-83614

A flaw was found in xmldom. Two independent quadratic paths in the XML DOM Document Object Model parser can lead to a denial of service DoS. A remote attacker could exploit this by providing specially crafted XML input, causing the parser to repeatedly rescan malformed tag names or reindex and...

CVE-2026-82735

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expression to run on input that a length constraint should have already rejected. Ash.Type.String.applyconstraints/2 lib/ash/type/string.ex evaluated the :match regex regardless of...

CVE-2026-82736

ash-project ash (Elixir web framework) contains an Incorrect Behavior Order: Validate Before Canonicalize vulnerability in Ash.Type.CiString.apply_constraints/2 (lib/ash/type/ci_string.ex). The max_length , min_length , and match constraints were validated against the value as submitted , while t...

PT-2026-84499

A format string vulnerability exists in the command line interface of AOS-CX that could lead to unauthenticated remote code execution. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system...