CVE-2026-19953

A flaw was found in the URI component for Perl. This vulnerability occurs because the nameprep function, responsible for encoding hostnames, does not properly normalize Unicode characters. As a result, a hostname that is not in a standard Unicode form non-NFC can be encoded into a non-standard...

CVE-2026-26128

CVE-2026-26128 Windows Active Directory에서 유니코드 정규화를 통해 Kerberos 리플렉션을 악용하는 Python 도구입니다. Guillaume André / Synacktiv의 연구를 기반으로 합니다. 설치 이 도구들은 Python 3.8+에서만 호환됩니다. GitHub에서 저장소를 클론하고, 의존성을 설치하면 바로 사용할 수 있습니다: git clone https://github.com/jarnovandenbrink/CVE-2026-26128.git cd CVE-2026-26128 pip...

CVE-2026-2395

CVE-2026-23950 CVE-2026-23950에 대한 개념 증명 - tar 패키지의 경쟁 조건 취약점. 설명 이 저장소는 tar npm 패키지버전 7.5.3의 경쟁 조건 취약점을 시연하며, 추출 중 파일 충돌을 허용합니다. 이 취약점은 대소문자를 구분하지 않는 충돌로 인해 collisionss와 collisionß가 동일한 파일로 처리될 수 있는 유니코드 정규화 차이를 악용합니다. 취약점 세부 정보 CVE ID : CVE-2026-23950 영향을 받는 패키지 : tar 영향을 받는 버전 : 7.5.3 취약점 유형 : ...

CVE-2023-46404

CVE-2023-46404 PCRS는 토론토 대학교에서 개발된 온라인 프로그래밍 연습용 웹 애플리케이션입니다. Bitbucket 저장소를 참조하십시오: https://bitbucket.org/utmandrew/pcrs/src/3.11/ 요약 코드 제출 기능이 있는 PCRS의 “Questions” 페이지와 “Code editor” 페이지는 Python 샌드박스를 탈출하여 원격 코드 실행RCE에 취약합니다. 상세 정보 PCRS 인스턴스에서는 생성기generator 객체를 사용하여 원격 코드 실행이 가능합니다. 생성기...

CVE-2025-52488

DNN 유니코드 경로 정규화 NTLM 해시 노출 익스플로잇 CVE-2025-52488 개요 이 익스플로잇은 DNN구 DotNetNuke 6.0.0 이상 10.0.1 미만 버전에서 유니코드 경로 정규화 공격을 통해 공격자가 NTLM 해시를 노출할 수 있는 취약점을 대상으로 합니다. 취약점 세부 정보 CVE ID : CVE-2025-52488 심각도 : 높음 CVSS 8.6 영향받는 버전 : 6.0.0 이상 10.0.1 미만 공격 벡터 : 네트워크 인증 : 필요하지 않음 작동 원리 이 익스플로잇은 Windows/.NET의 특성과...

AlmaLinux 9.2 [TuxCare] Security Update: python3-setuptools / python3-setuptools-wheel (ALMALINUX9.2:CLSA-2026:1786468462)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1786468462 advisory. - setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList...

CVE-2025-64458-Demo

CVE-2025-64458 — Django 리디렉션 DoS Windows 설명 Django 리디렉션 응답의 서비스 거부DoS 문제로, 공격자가 리디렉션 응답을 구성할 때 URL 정규화 과정에서 과도한 CPU 작업을 유발할 수 있습니다. Windows에서는 Python의 Unicode NFKC 정규화가 특히 느립니다. 그 결과, 공격자가 제어하는 매우 큰 유니코드 URL로 HttpResponseRedirect/HttpResponsePermanentRedirect를 생성하거나 django.shortcuts.redirect를 사용하...

CVE-2026-14978

A flaw was found in go-slug. A local attacker could bypass .terraformignore exclusions, leading to sensitive files being included in Terraform slug uploads. This is caused by improper handling of Unicode normalization during path matching. Mitigation Upgrade to go-slug 0.18.3 or later. Where an...

SUSE-SU-2026:4046-1 Security update for perl-URI

This update for perl-URI fixes the following issue: - CVE-2026-19953: non-NFC host names encoded to non-standard punycode labels due to missing normalization in nameprep bsc1277886...

OESA-2026-3591 perl-URI security update

This module implements the URI class. Objects of this class represent "Uniform Resource Identifier references" as specified in RFC 2396 and updated by RFC 2732. Security Fixes: URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in...

OESA-2026-3590 perl-URI security update

This module implements the URI class. Objects of this class represent "Uniform Resource Identifier references" as specified in RFC 2396 and updated by RFC 2732. Security Fixes: URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in...

OESA-2026-3588 perl-URI security update

This module implements the URI class. Objects of this class represent "Uniform Resource Identifier references" as specified in RFC 2396 and updated by RFC 2732. Security Fixes: URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in...

Security Bulletin: IBM Maximo Application Suite - Predict Component uses multiple dependencies which are vulnerable to multiple CVEs.

Summary BM Maximo Application Suite - Predict Component uses setuptools-80.10.2-py3-none-any.whl Publicly disclosed vulnerability found by Scanner which are vulnerable to CVE-2026-59890. This bulletin contains information addressing the vulnerability. Vulnerability Details CVEID:CVE-2026-59890...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Cloud Pak for Business Automation released in August 2026. Vulnerability Details CVEID:CVE-2026-12590 DESCRIPTION: Impact: In body-parser versions prior to 1.20.6...

CVE-2026-13723

A flaw was found in electron-builder. An attacker can exploit a Unicode Normalization Collision, combined with symlink following behavior, within the zipx.Unzip extraction routine. By crafting a malicious ZIP archive, the attacker can cause the application to treat certain Unicode equivalent...

EUVD-2026-68681

URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep. nameprep lowercases each host label but performs no Unicode normalization. IDNA requires a label to be normalized to Form C before it is encoded RFC 5891, so a label...

PT-2026-83938

Name of the Vulnerable Software and Affected Versions URI for Perl versions prior to 5.36 Description Missing normalization in nameprep causes non-NFC host names to be encoded into non-standard punycode labels. While nameprep lowercases host labels, it fails to perform Unicode normalization to Fo...

PT-2026-89663

URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep. nameprep lowercases each host label but performs no Unicode normalization. IDNA requires a label to be normalized to Form C before it is encoded RFC 5891, so a label...

Unity Linux 20.1070e Security Update: python-setuptools (UTSA-2026-104947)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104947 advisory. setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude,...

SUSE CVE-2026-14978

HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching...