CVE-2023-41080

脆弱: http://localhost:8081//secret.html;@example.com 任意のWebサイトにリダイレクトされます（この場合は、https://example.com）。 修正済み: http://localhost:8082//secret.html;@example.com 参照: https://github.com/advisories/GHSA-q3mw-pvr8-9ggc...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git-lfs (UTSA-2026-124474)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-124474 advisory. The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to ...

EulerOS Virtualization 2.11.0 : python-requests (EulerOS-SA-2026-3554)

According to the versions of the python-requests packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : An unclaimed Amazon S3 bucket, 'codeconf', is referenced in an audio file link within the .rst documentation file. This...

Security Bulletin: IBM Virtualization Engine TS7700 is susceptible to multiple vulnerabilities in Python.

Summary IBM Virtualization Engine TS7700 is susceptible to two Tampering conditions and one potential Elevation of Privilege issue due to the use of Python CVE-2025-0938, CVE-2025-47273, CVE-2025-1795. TS7700 uses Python to perform operations with the Cloud and internal system configuration tasks...

Astra Linux – Vulnerability in Firefox and Thunderbird

The concurrent use of the URL parser with non-UTF-8 data was not thread-safe. This could lead to a “use-after-free” condition, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR 102.3, Thunderbird 102.3, and Firefox 105...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ruby (UTSA-2023-001257)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-001257 advisory. A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It...

CVE-2026-88056 Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClien...

CVE-2026-88056

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClien...

PT-2026-89560

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClien...

PT-2026-89690

Summary A discrepancy between WHATWG URL parsing and Angular SSR's URL resolution allows attackers to bypass same-origin checks and cause Server-Side Request Forgery SSRF, potentially leaking sensitive server-side credentials. Technical Description When applications validate incoming URLs using t...

NewStart CGSL MAIN 7.02 : python-webob Vulnerability (NS-SA-2026-0107)

The remote NewStart CGSL host, running version MAIN 7.02, has python-webob packages installed that are affected by a vulnerability: - WebOb provides objects for HTTP requests and responses. When WebOb normalizes the HTTP Location header to include the request hostname, it does so by parsing the U...

SUSE CVE-2026-53551

free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the free5GC AUSF Authentication Server Function does not validate the supiOrSuci field in UE authentication requests. Null bytes \x00 and other control characters pass through JSON parsing unchanged and are forwarded...

Security Bulletin: Watson Machine Learning on Cloud Pak for Data is affected by net/url (Publicly disclosed vulnerability) ( CVE-2025-47912)

Summary Watson Machine Learning on Cloud Pak for Data is affected by CVE-2025-47912 Vulnerability Details CVEID:CVE-2025-47912 DESCRIPTION: The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6...

CVE-2026-84394

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse returns it as the ho...

DEBIAN-CVE-2026-84394

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse returns it as the ho...

UBUNTU-CVE-2026-84394

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse returns it as the ho...

SUSE CVE-2026-82247

gitoxide's gix-url crate ?@ so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions = 0.49.0 fixed in 0.58.1...

CVE-2026-84394

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse returns it as the ho...

GHSA-F65P-4M7J-42XC fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization

Impact fast-uri does not validate the complete RFC 3986 grammar for bracketed IPv6 literals, so a malformed literal with invalid trailing text is silently truncated to a different valid IPv6 address with no error reported. For example, normalize'http://::not-valid/private' returns...

CVE-2026-82247

gitoxide's gix-url crate ?@ so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions = 0.49.0 fixed in 0.58.1...