23740 matches found
CVE-2026-6790: Improper Input Validation
In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present. This was not enforced in earlier HTTP RFC for example, in RFC 2616, but it is in the latest RFC 9110 and 9112. This...
The vulnerability of the server demon Incus in the container management system and the Incus Virtual Machine Manager allows a hacker to perform an SSRF attack.
The vulnerability of the server daemon incus in the container management and virtual machine manager system is related to insufficient validation of requests on the server side. Exploiting this vulnerability allows a malicious actor to execute an SSRF attack...
The vulnerability of the server daemon incusd in the container management system and the Incus virtual machine manager allows a hacker to trigger a service failure.
The vulnerability of the server daemon incus in the container management system and the Incus Virtual Machine Manager is related to the handling of pointers. Exploiting this vulnerability could allow a malicious actor to cause service failures...
The vulnerability of the client OVN in the container management system and the Incus virtual machine manager allows a attacker to carry out a “man-in-the-middle” attack.
The vulnerability of the client OVN in the container management system and the Incus virtual machine manager is related to errors in the TLS certificate validation process. Exploiting this vulnerability allows a remote attacker to carry out a “man-in-the-middle” attack...
PT-2026-58976
Summary Anyquery's server mode lacks input sanitization and access control over its built-in SQLite virtual table modules e.g., csv reader, log reader. Unauthenticated attackers connecting to the MySQL-compatible server port can create virtual tables pointing to local files on the system e.g.,...
CVE-2026-53365
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix zerocopy completion for multi-skb sends When a large message is fragmented into multiple skbs, the zerocopy uarg is only allocated and attached to the last skb in the loop. Non-final skbs carry pinned user pages...
EUVD-2026-43513
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix zerocopy completion for multi-skb sends When a large message is fragmented into multiple skbs, the zerocopy uarg is only allocated and attached to the last skb in the loop. Non-final skbs carry pinned user pages...
PYSEC-2026-2497 Glances is Vulnerable to Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py
Summary The Glances KVM/QEMU monitoring engine glances/plugins/vms/engines/virsh.py passes VM domain names, read directly from virsh list --all output, into f-string command templates that are processed by securepopen. securepopen is explicitly designed to interpret &&, |, and as shell operators...
OpenStack Cinder, glance, and Nova vulnerable to Path Traversal
An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that references a specific backing file path, a...
kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected role
A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM x86 shadow paging mechanism. This vulnerability occurs when a host page directory entry PDE mapping is changed from within the guest, leading to an unexpected role mismatch in shadow paging. This mismatch can cause a...
CVE-2026-23560
A flaw was found in Xen. A virtual machine administrator vm-admin can exploit this by setting the VM.other-config:issystemdomain parameter, which allows them to mark a virtual machine as a system domain. This can lead to the virtual machine being ignored and remaining operational during critical...
SnowCrasher
SnowCrasher This project is an introduction to cyber security...
Boot2Root
Boot2Root A cybersecurity challenge focused on penetration...
PT-2026-57837
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.0.11 Linux kernel versions prior to 7.1 Linux kernel versions prior to 6.7 Linux kernel versions prior to 6.18.34 Description A memory management issue exists in the net/vmw vsock/virtio transport common.c file...
Prezta: Provable Remote Execution of Zero-Trust Authorization Using SNARKs
Modernizing the security of operational technology systems that control critical infrastructure has become a pressing challenge. Because edge devices have limited capabilities, modernization has relied on application gateways that interface with identity management systems and enforce access...
The vulnerability of the vm2 package manager’s code transformer allows a hacker to execute arbitrary code.
The vulnerability of the vm2 package manager’s code transformation transformer is related to a breach of data protection mechanisms. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...
The vulnerability of the server daemon incusd in the container management system and the Incus virtual machine manager allows a hacker to trigger a service failure.
The vulnerability of the server daemon incus in the container management system and the Incus Virtual Machine Manager is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures...
RLSA-2026:36956 Important: kernel security update
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: net/sched: ets: Always remove class from active list before deleting in etsqdiscchange CVE-2025-71066 kernel: sctp: revalidate list cursor after sctpsendmsgtoasoc in SCTPSENDALL...
