CVE-2026-47128

The CVE concerns the nono sandbox tool (pre-0.55.0) where Landlock/seccomp policies allowed access to local Unix domain sockets (concrete and abstract). This enabled sandbox escape by contacting the per-user systemd DBus socket, with the root cause being incomplete mediation of local IPC. Impact ...

CVE-2026-47128 nono: Sandbox escape on Linux via D-Bus: `systemd-run --user`

nono is software that allows users to run AI agents in a zero-latency sandbox. Prior to version 0.55.0, the nono Landlock/seccomp policies allow access to local Unix domain sockets concrete and abstract. This allows an easy sandbox escape by talking to the per-user systemd dbus socket. Version...

openSUSE 16 Security Update : golang-github-prometheus-alertmanager (openSUSE-SU-2026:21157-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21157-1 advisory. Changes in golang-github-prometheus-alertmanager: - CVE-2026-39821: Fix validation bypass and privilege escalation by updating golang.org/x/net to versi...

OPENSUSE-SU-2026:20853-1 Security update for hauler

This update for hauler fixes the following issues: Changes in hauler: - update x/net to v0.55.0 bsc1266602, CVE-2026-39821...

Go Net HTML parser is vulnerable to denial of service

In Go Net golang.org/x/net before verion 0.55.0, parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service...

Inefficient Algorithmic Complexity

Overview github.com/golang/net/html is a package that implements an HTML5-compliant tokenizer and parser. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in parse.go, when checking attributes iteratively. An attacker can cause excessive CPU consumption by...

CVE-2026-24853

Caido is a web security auditing toolkit. Prior to 0.55.0, Caido blocks non whitelisted domains to reach out through the 8080 port, and shows Host/IP is not allowed to connect to Caido on all endpoints. But this is bypassable by injecting a X-Forwarded-Host: 127.0.0.1:8080 header. This...

CVE-2026-24853 Caido has an insufficient patch for DNS rebind leading to RCE

Caido is a web security auditing toolkit. Prior to 0.55.0, Caido blocks non whitelisted domains to reach out through the 8080 port, and shows Host/IP is not allowed to connect to Caido on all endpoints. But this is bypassable by injecting a X-Forwarded-Host: 127.0.0.1:8080 header. This...

CVE-2026-24853

Caido is a web security auditing toolkit. Prior to 0.55.0, Caido blocks non whitelisted domains to reach out through the 8080 port, and shows Host/IP is not allowed to connect to Caido on all endpoints. But this is bypassable by injecting a X-Forwarded-Host: 127.0.0.1:8080 header. This...

CVE-2026-24853 Caido has an insufficient patch for DNS rebind leading to RCE

Caido is a web security auditing toolkit. Prior to 0.55.0, Caido blocks non whitelisted domains to reach out through the 8080 port, and shows Host/IP is not allowed to connect to Caido on all endpoints. But this is bypassable by injecting a X-Forwarded-Host: 127.0.0.1:8080 header. This...

CVE-2026-24853 Caido has an insufficient patch for DNS rebind leading to RCE

Caido is a web security auditing toolkit. Prior to 0.55.0, Caido blocks non whitelisted domains to reach out through the 8080 port, and shows Host/IP is not allowed to connect to Caido on all endpoints. But this is bypassable by injecting a X-Forwarded-Host: 127.0.0.1:8080 header. This...

PT-2026-8042

Name of the Vulnerable Software and Affected Versions Caido versions prior to 0.55.0 Description Caido is a web security auditing toolkit. Before version 0.55.0, the software blocked connections from non-whitelisted domains attempting to reach the 8080 port, displaying a message indicating the...

AZL-68778 CVE-2025-59530 affecting package coredns for versions less than 1.11.4-11

quic-go is an implementation of the QUIC protocol in Go. In versions prior to 0.49.0, 0.54.1, and 0.55.0, a misbehaving or malicious server can cause a denial-of-service DoS attack on the quic-go client by triggering an assertion failure, leading to a process crash. This requires no authenticatio...

CVE-2023-47620 Scrypted reflected Cross-site Scripting vulnerability

Scrypted is a home video integration and automation platform. In versions 0.55.0 and prior, a reflected cross-site scripting vulnerability exists in the plugin-http.ts file via the owner' and 'pkg parameters. An attacker can run arbitrary JavaScript code...

Scrypted Cross-Site Scripting Vulnerability

Scrypted is a high-performance home video integration platform with intelligent detection by the individual developer Koushik Dutta. A cross-site scripting vulnerability exists in Scrypted 0.55.0 and earlier versions, which stems from the presence of a reflective cross-site scripting vulnerabilit...

Poppler pdfunite Denial of Service Vulnerability

Poppler is a C++ class library for generating PDF, the library is inherited from Xpdf PDF reader. pdfunite is a Ruby wrapper. Poppler 0.55.0 and previous versions of pdfunit has a security vulnerability. An attacker can exploit this vulnerability to cause a denial of service...

Design/Logic Flaw

poppler through version 0.55.0 is vulnerable to an uncontrolled recursion in pdfunite resulting into potential denial-of-service...

CVE-2017-7515

poppler through version 0.55.0 is vulnerable to an uncontrolled recursion in pdfunite resulting into potential denial-of-service...