24997 matches found
CVE-2026-81632
AshAuthenticationPhoenix (team-alembic), an Elixir authentication library for Phoenix, places a single-use sign-in token as a query parameter in a GET redirect after successful password authentication. The token travels in the request line, where it is retained by access logs, reverse proxies, an...
EEF-CVE-2026-81632 Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Summary Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in,...
CVE-2026-81479
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Partial String Comparison vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service...
CVE-2026-92925 Redis: redis: out-of-bounds read via crafted cluster bus packets
A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds...
EUVD-2026-81458
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Partial String Comparison vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service...
CVE-2026-81479
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Partial String Comparison vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service...
CVE-2026-81479
Dell OpenManage Server Administrator versions prior to 11.1.0.3 contain a Partial String Comparison vulnerability. A low-privileged attacker with local access can exploit this flaw to cause a Denial of Service . The CVSS 3.1 score is 5.8 (MEDIUM) , reflecting a local attack vector with high compl...
net/mail: golang: net/mail: Denial of Service via pathological email address parsing
A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...
CLEANSTART-2026-JK52932 expansion of '\h' in the prompt string in bash 4
Security vulnerability affects the bash package. The expansion of '\h' in the prompt string in bash 4...
PT-2026-94471
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the irqchip/ast2700-intc component where the irq domain activate callback is called from setup irq while desc-lock is held and interrupts are disabled. The functions...
PT-2026-94391
Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions prior to 9.18 Description The Backup tool in pgAdmin 4 fails to validate the database field within the /backup/job//object endpoint. This field is appended as a positional argument to the pg dump utility. Since pg dump uses...
CVE-2026-81479: Partial String Comparison
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Partial String Comparison vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service...
CVE-2026-86864: Improper Neutralization of Argument Delimiters in a Command
pgAdmin 4's Backup tool appended the client-supplied 'database' field from the /backup/job/ /object request to the pgdump argument vector as a bare trailing positional argument, without validation. Because pgdump parses its options with getoptlong, which permutes arguments, a value beginning with...
CVE-2026-92758: Insertion of Sensitive Information into Log File
If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information if in use such as passwords and AWS secure access keys...
CVE-2026-92757: Missing Encryption of Sensitive Data
Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption...
PT-2026-95073
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description When the logging mode is configured as DEBUG or a malformed MongoDB connection string is utilized, application logs may inadvertently capture sensitive data,...
PT-2026-95080
Name of the Vulnerable Software and Affected Versions MongoDB Entity Framework Core Provider affected versions not specified Description Applications using the MongoDB Entity Framework Core Provider may inadvertently disable field level encryption if a database name is included within the...
CVE-2026-81632: Use of GET Request Method With Sensitive Query Strings
Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in,...
PT-2026-94234
Name of the Vulnerable Software and Affected Versions Dell OpenManage Server Administrator versions prior to 11.1.0.3 Description A Partial String Comparison issue exists where a low privileged attacker with local access could trigger a Denial of service. Partial String Comparison occurs when a...
PT-2026-94788
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SCSI UFS core where string descriptors are not properly validated. The utf16s to utf8s function expects a count of UTF-16 code units rather than bytes. Because the...