13018 matches found
Moderate: perl-URI security update
This module implements the URI class. Objects of this class represent "Uniform Resource Identifier references" as specified in RFC 2396 and updated by RFC 2732. Security Fixes: URI: URI for Perl: Security bypass due to incorrect hostname encoding via missing Unicode normalization CVE-2026-19953 F...
CLSA-2026-1792143884 TuxCare security update for fast-uri (7 CVEs)
TuxCare rebuilt fast-uri to address 7 CVEs. Fixed in 3.0.6-tuxcare.2...
AlmaLinux 9.2 [TuxCare] Security Update: pcs / pcs-snmp Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792125039)
The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792125039 advisory. - decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS. CVE-2022-38900 - Rack is a modular Ruby we...
AlmaLinux 10 : libsoup3 (ALSA-2026:83618)
The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:83618 advisory. libsoup: libsoup: Heap buffer overflow via uninitialized length in data-URI base64 decoding CVE-2026-102555 libsoup: libsoup: Heap buffer overflow from...
Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in fast-uri (CVE-2026-84292, CVE-2026-84394)
Summary IBM Db2 Developer Extension is affected by vulnerability in fast-uri CVE-2026-84292, CVE-2026-84394 Vulnerability Details CVEID:CVE-2026-84292 DESCRIPTION: fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host componen...
CVE-2026-55467
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and...
Important: Red Hat Security Advisory: libsoup3 security update
An update for libsoup3 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...
libsoup: libsoup: Heap buffer overflow via uninitialized length in data-URI base64 decoding
A flaw was found in libsoup. The soupuridecodedatauri function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling gbase64decodeinplace. If the percent-decoded payload contained embedded NUL bytes, the decoded length could remain uninitialized and be used as the si...
Astra Linux – Vulnerability in Python-Django
In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uritoiri is susceptible to a potential Denial-of-Service DoS attack due to certain inputs containing a very large number of Unicode characters...
Astra Linux – Vulnerability in Ruby 2.5
URI is a module that provides classes for handling Uniform Resource Identifiers. In versions 0.12.4 and earlier bundled with Ruby 3.2 series, 0.13.2 and earlier bundled with Ruby 3.3 series, 1.0.3 and earlier bundled with Ruby 3.4 series, when using the + operator to combine URIs, sensitive...
Astra Linux – Vulnerability in Tomcat9
Apache Tomcat has a Relative Path Traversal vulnerability. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This created the possibility that, for rewrite rules that modify query parameters into the URL, an attacker could manipulate the...
Astra Linux – Vulnerability in Firefox and Thunderbird
An attacker could have injected CSS into stylesheets that are accessible via internal URIs, such as resource:, thereby bypassing a page’s Content Security Policy. This vulnerability affects Firefox ESR 91.11, Thunderbird 102, Thunderbird 91.11, and Firefox 101...
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Overview org.eclipse.jetty:jetty-server is a lightweight highly scalable java based web server and servlet engine. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' in the TryPathsHandler or...
PYSEC-2026-4243 Mako: Path traversal via drive-letter URI on Windows in TemplateLookup
Summary On Windows, a TemplateLookup URI beginning with a drive designator e.g. C:/../../secret.txt or C:....\secret.txt bypasses the directory traversal check in Template.init, allowing reads of files outside the configured template directory. This is a third, independent instance of the root...
EUVD-2026-101944
In Eclipse Jetty, TryPathsHandler and TryFilesFilter can be configured to forward requests to template URIs such as index?p=$path, where $path is the request path in context. However, URI paths may contain characters that are reserved in URI queries so that a path of /s&a=1 when applied to the...
CVE-2026-76182
In Eclipse Jetty, TryPathsHandler and TryFilesFilter can be configured to forward requests to template URIs such as index?p=$path, where $path is the request path in context. However, URI paths may contain characters that are reserved in URI queries so that a path of /s&a=1 when applied to the...
CVE-2026-76182
In Eclipse Jetty, TryPathsHandler and TryFilesFilter can be configured to forward requests to template URIs such as index?p=$path, where $path is the request path in context. However, URI paths may contain characters that are reserved in URI queries so that a path of /s&a=1 when applied to the...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.18.57 security and extras update
Red Hat OpenShift Container Platform release 4.18.57 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.18. Red Hat Product Security has rated this update as having a security impact of...
CLEANSTART-2026-YH79720 fast-uri is a dependency-free RFC 3986 URI parser for Node
Security vulnerability affects the langfuse package. fast-uri is a dependency-free RFC 3986 URI parser for Node...