117352 matches found
MiracleLinux 9 : runc-1.4.2-3.el9_8 (AXSA:2026-1907:04)
The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1907:04 advisory. net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56860 Tenable has extracted the preceding descriptio...
RHEL 7 : host-metering (RHSA-2026:71619)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:71619 advisory. Host metering service Security Fixes: net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56860...
UBUNTU-CVE-2026-97404
In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Si...
AlmaLinux 9 : skopeo (ALSA-2026:70641)
The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:70641 advisory. skopeo: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56858 skopeo: Go encoding/asn1: Denial of Service via excessive recursion ...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git-lfs (UTSA-2026-124463)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-124463 advisory. The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the...
CVE-2026-97404
In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Si...
Linux Distros Unpatched Vulnerability : CVE-2026-97404
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. By sending a request with an empty URL-Signature header, an unauthenticate...
ReconHound
ReconHound ReconHound es una herramienta de reconocimiento web basada en Python, diseñada para probadores de penetración, cazadores de recompensas por errores y hackers éticos. Ayuda a identificar rutas ocultas, archivos, subdominios, parámetros de consulta, hosts virtuales y puntos finales...
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...
CVE-2026-71463
Notification template Jinja AST whitelist only inspects static Getattr nodes. Dynamic subscripts job'job'+'env' and % if job.id 100 % conditional gating bypass both the AST check and the test-render stub has small job.id. At runtime, the gated branch executes and exceptions write full tracebacks...
CVE-2026-71458
URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC. The 403→404 shim only rewrites 403 responses, leaving the pk=0 miss path with a different 404 detail string. Differential "Not found." vs "No matches..." reveals whether a named resource org,...
CVE-2026-71463
Notification template Jinja AST whitelist only inspects static Getattr nodes. Dynamic subscripts job'job'+'env' and % if job.id 100 % conditional gating bypass both the AST check and the test-render stub has small job.id. At runtime, the gated branch executes and exceptions write full tracebacks...
CVE-2026-71458
URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC. The 403→404 shim only rewrites 403 responses, leaving the pk=0 miss path with a different 404 detail string. Differential "Not found." vs "No matches..." reveals whether a named resource org,...
CVE-2026-71458 Automation-controller: automation-controller-container: automation-controller: named-url 404 body oracle enables cross-tenant resource name enumeration
URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC. The 403→404 shim only rewrites 403 responses, leaving the pk=0 miss path with a different 404 detail string. Differential "Not found." vs "No matches..." reveals whether a named resource org,...
CVE-2026-71458 Automation-controller: automation-controller-container: automation-controller: named-url 404 body oracle enables cross-tenant resource name enumeration
URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC. The 403→404 shim only rewrites 403 responses, leaving the pk=0 miss path with a different 404 detail string. Differential "Not found." vs "No matches..." reveals whether a named resource org,...
runc security update
An update is available for runc. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The runC tool is a lightweight, portable implementation of the Open Container...