50793 matches found
CVE-2026-58214
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, an authenticated MQTT client could subscribe to the internal $MQTT.deliver.pubrel subject family, bypassing configured subscribe permissions and exposing MQTT QoS2 protoc...
EUVD-2026-42386
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.8, message trace destination checks were applied to ordinary client connections but not consistently to messages arriving through leafnode connections, allowing a leafnode...
CVE-2026-58254 NATS Server: Incomplete fix for CVE-2026-33249: Leaf node connections bypass Nats-Trace-Dest permission check
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.8, message trace destination checks were applied to ordinary client connections but not consistently to messages arriving through leafnode connections, allowing a leafnode...
CVE-2026-53166
creationtimestamp| type| source ---|---|--- 2026-07-08 19:53:22+00:00| seen| https://bsky.app/profile/grsecurity.bsky.social/post/3mq5vhkasy22p 2026-07-08 19:55:17+00:00| seen| https://bsky.app/profile/grsecurity.bsky.social/post/3mq5vkydkjc2p 2026-10-01 18:00:00+00:00| seen|...
EUVD-2026-42380
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.12.8 and 2.11.17, an unauthenticated peer with network access to a leafnode listener with compression enabled could crash the server during the pre-authentication leafnode handshake by...
httpd: httpd: HTTP/2 Remote Denial of Service via compression bomb and Slowloris-style attack
A flaw was found in HTTP/2, affecting various web servers. A remote attacker can exploit this vulnerability by combining an HPACK compression bomb with a zero-byte flow-control window. This technique allows a small amount of data to expand into large memory allocations on the server, which are th...
CVE-2026-10536
A flaw was found in libcurl. This use-after-free vulnerability occurs when an application configures an HTTP/2 stream-dependency tree and then performs a sequence of operations involving curleasyreset and curleasycleanup. During the final cleanup, libcurl attempts to access memory that has alread...
nginx:1.26 security, bug fix, and enhancement update
An update is available for nginx, module.nginx. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list nginx is a web and proxy server supporting HTTP and other...
CVE-2026-0280
creationtimestamp| type| source ---|---|--- 2026-07-08 17:38:13+00:00| seen| https://bsky.app/profile/scotthogg.bsky.social/post/3mq5nwfhtlc2s 2026-07-08 19:03:27+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3mq5sossn5l2f 2026-07-09 04:46:13+00:00| seen|...
CVE-2026-59892
OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx- HTTP header values with decodeURIComponent without handling decode errors, allowing an unauthenticated remote attacker to send a malformed...
DEBIAN-CVE-2026-59882
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost does not reject URI host components containing authority delimiters, embedded ports, or malformed IPv6 brackets, allowing Uri::getHost to disagree with the URI authority used for security ...
Important: Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.29.0 Release.
Red Hat OpenShift Dev Spaces 3.29.0 has been released. Red Hat OpenShift Dev Spaces provides a cloud developer workspace server and a browser-based IDE built for teams and organizations. Dev Spaces runs in OpenShift and is well-suited for container-based development. The 3.29 release is based on...
SQL Injection
Overview Affected versions of this package are vulnerable to SQL Injection via unsanitized data source input in the process. An attacker can execute arbitrary SQL commands and gain unauthorized access to sensitive data or create accounts with attacker-controlled credentials by influencing a...
CVE-2018-20599
creationtimestamp| type| source ---|---|--- 2026-07-08 16:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq5kj5avp323 2026-07-08 16:37:08+00:00| seen| https://bsky.app/profile/potato.software/post/3mq5kj6ilvn2v...
MAL-2026-6995 Malicious code in chai-redirection (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38236fbbdbbaa8f8ed9315c3a4ff01fbf049215896036b1cb68611681fe0eb00 chai-redirection presents itself as a chai assertion plugin but its main entry index.js unconditionally spawns a detached Node child process running...
CVE-2026-59927 Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the Include directive in src/mistune/directives/include.py detects only direct self-includes and not indirect cycles, allowing two markdown files that include each other to trigger unbounded recursion, raise...
CVE-2026-41042
creationtimestamp| type| source ---|---|--- 2026-07-08 16:20:38+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mq5jlooecl2f 2026-07-08 16:24:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq5jrsw37s22 2026-08-17 18:00:03+00:00| seen|...
CVE-2026-59926 Mistune: XSS via unescaped class option in Admonition directive
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, renderadmonition in src/mistune/directives/admonition.py concatenates the Admonition directive :class: option into the HTML class attribute without escaping, allowing attribute injection and cross-site scripting even...
CVE-2026-59892 OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header
OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx- HTTP header values with decodeURIComponent without handling decode errors, allowing an unauthenticated remote attacker to send a malformed...
