2310 matches found
CVE-2026-25673
A flaw was found in Django. A remote attacker can exploit a vulnerability in the URLField.topython function, specifically when Django is running on the Windows platform. This function, which utilizes urllib.parse.urlsplit, performs a disproportionately slow normalization process for certain Unico...
ALSA-2026:3753 Important: osbuild-composer security update
A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fixes: crypto/x50...
CVE-2026-27600
CVE-2026-27600 : In HomeBox, prior to version 0.24.0-rc.1, the notifier allows authenticated users to specify arbitrary URLs for HTTP POST requests without validating host/IP/port. This can yield a behavioral side-channel that enables internal service enumeration, as the UI behavior varies with t...
CVE-2026-3204
CVE-2026-3204 describes an improper input validation in the error message page of Devolutions Server, enabling remote attackers to spoof the displayed error message via a specially crafted URL. Public references consistently cite Devolutions Server 2025.3.16 and earlier as affected; connected sou...
OpenClaw's web tools strict URL guard could lose DNS pinning when env proxy is configured
Summary openclaw web tools strict URL fetch paths could lose DNS pinning when environment proxy variables are configured HTTPPROXY/HTTPSPROXY/ALLPROXY, including lowercase variants. In affected builds, strict URL checks for example webfetch and citation redirect resolution validated one destinati...
Django vulnerable to Uncontrolled Resource Consumption
An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. URLField.topython in Django calls urllib.parse.urlsplit, which performs NFKC normalization on Windows that is disproportionately slow for certain Unicode characters, allowing a remote attacker to cause denial o...
CVE-2025-58335
creationtimestamp| type| source ---|---|--- 2026-03-03 15:01:27+00:00| seen| https://gist.github.com/openjny/0f6c31694b4337dd06b63c352290b14f...
CVE-2026-25673 Potential denial-of-service vulnerability in URLField via Unicode normalization on Windows
An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. URLField.topython in Django calls urllib.parse.urlsplit, which performs NFKC normalization on Windows that is disproportionately slow for certain Unicode characters, allowing a remote attacker to cause denial o...
CVE-2026-25673 Potential denial-of-service vulnerability in URLField via Unicode normalization on Windows
An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. URLField.topython in Django calls urllib.parse.urlsplit, which performs NFKC normalization on Windows that is disproportionately slow for certain Unicode characters, allowing a remote attacker to cause denial o...
PT-2026-22829
Name of the Vulnerable Software and Affected Versions Devolutions Server versions 2025.3.15 and earlier Description A flaw exists in the error message page that allows remote attackers to manipulate the displayed error message through a crafted URL. The issue is due to insufficient input...
Requests Vulnerable to Information Disclosure via '.netrc' Credentials Leak in 'get_netrc_auth()' Function
Requests is vulnerable to leakage of .netrc credentials due to a URL parsing issue. An attacker could exploit this by supplying a maliciously-crafted URL to a victim, which could result in loss of said credentials and can be potentially used for accessing remote servers...
Allocation of Resources Without Limits or Throttling
Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the downloadFile function via the update-cache command. An attacker can cause disk exhaustion by supplying a malicious URI in the configuration, leading to unbounded downloads and...
CVE-2026-28361
creationtimestamp| type| source ---|---|--- 2026-03-02 20:10:09+00:00| seen| https://gist.github.com/alon710/6187e996b9891bde691d927e61e7e5eb...
PT-2026-22580
Name of the Vulnerable Software and Affected Versions DobryCMS versions prior to 8.0 Description A Blind SQL injection issue exists in DobryCMS. An unauthenticated remote attacker can inject SQL syntax into a URL path, leading to a Blind SQL injection. The vulnerability allows for the injection o...
RHEL 8 : go-toolset:rhel8 (RHSA-2026:3471)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:3471 advisory. Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fixes: golang: archive/zi...
CVE-2026-3388
creationtimestamp| type| source ---|---|--- 2026-03-01 13:43:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfyunj4z5g2y...
CVE-2026-28417 Vim has OS Command Injection in netrw
Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL e.g., using the scp:// protocol handler, an attacker can execute arbitrary shell command...
CVE-2026-25147
creationtimestamp| type| source ---|---|--- 2026-02-27 17:14:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfu7ik7zfb2k 2026-03-04 00:20:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mg6z66ywo723...
