172731 matches found
Rapid7 Analysis: Microsoft SharePoint JWT Token Authentication Bypass (CVE-2026-55040)
Overview On July 14, 2026, Rapid7 and Microsoft disclosed CVE-2026-55040, an authentication bypass vulnerability affecting Microsoft SharePoint. Today we are publishing a technical analysis of the vulnerability along with an accompanying proof-of-concept PoC script. Figure 1: The Rapid7 Labs PoC...
EUVD-2026-56120
A vulnerability has been identified in Simcenter Nastran All versions V2606. The affected applications contain a stack overflow vulnerability while parsing specially strings as argument for one of the application binaries. This could allow an attacker to execute code in the context of the current...
EUVD-2026-56108
Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulnerability in the GraphQL saveAsset mutation, which fetches an attacker-supplied URL server-side. The anti-SSRF validation is incomplete: validateIp does not cover CGNAT 100.64.0.0/...
EUVD-2026-56136
FreeRDP before 3.30.0 contains a server-side authentication bypass in the RDSTLS handshake. When a server is configured with RdstlsSecurity = TRUE, the handshake dispatches inbound PDUs based solely on the attacker-supplied wire pduType without verifying that the received PDU is the one required ...
crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
A flaw was found in the crypto/x509 package of golang. This vulnerability allows a remote attacker to cause a Denial of Service DoS by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name SAN entries. The certificate verification process, specifical...
apache-thrift: Apache Thrift: Denial of Service via multiple vulnerabilities
A flaw was found in Apache Thrift. This vulnerability encompasses an origin validation error, improper limitation of a pathname to a restricted directory path traversal, and improper neutralization of CRLF sequences in HTTP headers HTTP request/response splitting. A remote attacker could exploit...
apache-thrift: Apache Thrift: Denial of Service via multiple vulnerabilities
A flaw was found in Apache Thrift. This vulnerability encompasses an origin validation error, improper limitation of a pathname to a restricted directory path traversal, and improper neutralization of CRLF sequences in HTTP headers HTTP request/response splitting. A remote attacker could exploit...
golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...
crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
A flaw was found in the crypto/x509 package of golang. This vulnerability allows a remote attacker to cause a Denial of Service DoS by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name SAN entries. The certificate verification process, specifical...
SUSE-SU-2026:3577-1 Security update for snpguest
This update for snpguest fixes the following issues: - CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes bsc1274139. - CVE-2026-41678: openssl: incorrect bounds assertion in AES keywrap can lead to an out-of-bounds write bsc1270642. -...
Security update for snpguest
This update for snpguest fixes the following issues: CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes bsc1274139. CVE-2026-41678: openssl: incorrect bounds assertion in AES keywrap can lead to an out-of-bounds write bsc1270642. CVE-2026-4232...
golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...
apache-thrift: Apache Thrift: Denial of Service via multiple vulnerabilities
A flaw was found in Apache Thrift. This vulnerability encompasses an origin validation error, improper limitation of a pathname to a restricted directory path traversal, and improper neutralization of CRLF sequences in HTTP headers HTTP request/response splitting. A remote attacker could exploit...
CVE-2026-58231
SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high...
EUVD-2026-56037
A server-side request forgery vulnerability in Apioo Fusio 8.8.3 allows authenticated consumer-role users to make the server issue HTTP requests to internal network addresses by registering a webhook URL pointing to an internal host. The webhook registration endpoint validates URL syntax via...
CVE-2026-72598
A server-side request forgery vulnerability in Apioo Fusio 8.8.3 allows authenticated consumer-role users to make the server issue HTTP requests to internal network addresses by registering a webhook URL pointing to an internal host. The webhook registration endpoint validates URL syntax via...
CVE-2026-58231
An unauthenticated attacker can abuse a default authentication client in SAP Commerce Cloud's Data Hub Adapter to submit crafted input, enabling arbitrary code execution. CVSS 10.0; CIRCL confirms active exploitation. SAP patch note 3771065 provides fixes; IP Filter Set is a temporary workaround....
EUVD-2026-55999
SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high...
golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...
Origin Validation Error
Overview typo3/cms-install is a TYPO3 extension install. The Install Tool is used for installation, upgrade, system administration and setup tasks. Affected versions of this package are vulnerable to Origin Validation Error via referrer enforcement in the ReferrerEnforcer code used by the backend...