115113 matches found
Important: Red Hat Security Advisory: skopeo security update
An update for skopeo is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...
golang: net/url: Memory exhaustion in query parameter parsing in net/url
A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted...
net/url: Incorrect parsing of IPv6 host literals in net/url
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...
CVE-2026-44437: Improper Limitation of a Pathname to a Restricted Directory
The Angular SSR is a server-rise rendering tool for Angular applications. From 19.0.0-next.0 to before 19.2.25, 20.3.25, 21.2.9, and 22.0.0-next.7, a vulnerability exists in the X-Forwarded-Prefix header processing logic within Angular SSR. The internal validation mechanism fails to properly...
CubeCart 输入验证错误漏洞
CubeCart is an open-source e-commerce software developed by CubeCart. In versions 6.6.x to 6.7.1 of CubeCart, there is a vulnerability related to input validation errors. This vulnerability stems from directly constructing the CCSTOREURL constant from the Host request headers and embedding the...
ELECOM多款产品 安全漏洞
ELECOM WRC-BE72XSD-B is a wireless router produced by the ELECOM company. Several ELECOM products have security vulnerabilities. This vulnerability stems from the ability to access specific URLs without authentication, which may allow devices to be operated without proper authorization. The...
CVE-2026-44372: URL Redirection to Untrusted Site
Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could turn a redirect route rule using wildcards rewrite into a cross-host redirect by sliding an extra slash in after the rule prefix. This vulnerability is fixed in 3.0.260429-beta...
The vulnerability of the Mattermost instant messaging application, related to uncontrolled resource consumption, allows a hacker to redirect users to any arbitrary URL address.
The vulnerability of the Mattermost instant messaging application is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to redirect users to an arbitrary URL address...
Unity Linux 20.1050e / 20.1070e Security Update: golang (UTSA-2026-017806)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017806 advisory. url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. Tenable has extracted the preceding description block directly from t...
RHEL 10 : podman (RHSA-2026:17040)
The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:17040 advisory. The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use...
Important: git-lfs security update
Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fixes: net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 golang:...
ALSA-2026:16875 Important: git-lfs security update
Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fixes: net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 golang:...
CVE-2026-8052
creationtimestamp| type| source ---|---|--- 2026-05-12 23:50:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mloy5xmzq32c...
CVE-2026-44864
creationtimestamp| type| source ---|---|--- 2026-05-12 22:57:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlov74etf22p...
CVE-2026-44862
creationtimestamp| type| source ---|---|--- 2026-05-12 22:56:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlov3x2jk72i...
CVE-2026-44859
creationtimestamp| type| source ---|---|--- 2026-05-12 22:54:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlouyxaqx72e...
CVE-2026-44245 Kyverno: [policy-reporter-ui] XSS via Stored Property Values in PropertyCard Component
Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to 2.5.2, Vue 3's v-html directive is the framework-documented mechanism for injecting raw HTML, and it intentionally disables the auto-escaping that interpolation provides. The PropertyCard.vue component uses...
Cross-site Scripting (XSS)
Overview sillytavern is a LLM Frontend for Power Users Affected versions of this package are vulnerable to Cross-site Scripting XSS in the corsProxy file. An attacker can execute arbitrary JavaScript in the victim's browser and in the victim's context by injecting malicious content into the url...
GHSA-XC4X-2452-5GC9 SillyTavern has a reflected XSS vulnerability in the CORS proxy middleware
Resolution Fixed in SillyTavern 1.18.0: a user-provided URL is no longer reflected in the HTTP response body. Overview - Vulnerability Type: XSS - Affected Location: src/middleware/corsProxy.js:40 - Trigger Scenario: reflected XSS in CORS proxy error response Root Cause When fetchurl throws, the...