1041400 matches found
PYSEC-2026-629 Django Improper Access Control
The LazyUser class in the AuthenticationMiddleware for Django 0.95 does not properly cache the user name across requests, which allows remote authenticated users to gain the privileges of a different user...
Zope does not properly verify the access for objects with proxy roles
Zope 2.2.0 through 2.5.1 does not properly verify the access for objects with proxy roles, which could allow some users to access documents in violation of the intended configuration...
Out-of-bounds Write in OpenCV
In opencv calls that use libpng, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges required. User interaction is not required for exploitation. Product: AndroidVersions: Android-10Android...
Divide By Zero in OpenCV.
An issue was discovered in OpenCV 4.1.0 OpenCV-Python 4.1.0.25. There is a divide-by-zero error in cv::HOGDescriptor::getDescriptorSize in modules/objdetect/src/hog.cpp...
PYSEC-2026-684 Memory leak in Nanopb
Impact Decoding specifically formed message can leak memory if dynamic allocation is enabled and an oneof field contains a static submessage that contains a dynamic field, and the message being decoded contains the submessage multiple times. This is rare in normal messages, but it is a concern wh...
GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward
Summary The BalancerForward proxy helper in GoFiber uses Header.Add instead of Header.Set when injecting the X-Real-IP header. This appends the real client IP as a second header value rather than replacing any attacker-supplied value. Upstream servers that read the first X-Real-IP header nginx,...
CVE-2026-54431 Improper Data Validation in liboauth2
In liboauth2 the Demonstrating Proof-of-Possession DPoP verifier accepts a proof whose JSON Web Key jwk header contains private key material. RFC 9449 section 4.3 step 7 requires the verifier to reject such a proof but oauth2tokenverify function returns success for a malformed DPoP proof that...
RHSA-2026:34355 Red Hat Security Advisory: mod_http2 security, bug fix, and enhancement update
Bulletin has no description...
RHSA-2026:34192 Red Hat Security Advisory: buildah security, bug fix, and enhancement update
Bulletin has no description...
RHSA-2026:34109 Red Hat Security Advisory: httpd security, bug fix, and enhancement update
Bulletin has no description...
RHSA-2026:34095 Red Hat Security Advisory: kernel security, bug fix, and enhancement update
Bulletin has no description...
RHSA-2026:34094 Red Hat Security Advisory: kernel security, bug fix, and enhancement update
Bulletin has no description...
RHSA-2026:30267 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Bulletin has no description...
EUVD-2026-41201
Use after free in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Critical...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.19.36 bug fix and security update
Red Hat OpenShift Container Platform release 4.19.36 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.19. Red Hat Product Security has rated this update as having a...
netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation
A flaw was found in netty-handler, a component of the Netty network application framework. A remote attacker can exploit an incorrect masking operation in the IpSubnetFilterRule.compareTo function to bypass configured IPv6 subnet rules. This allows valid public IP addresses to circumvent intended...
PT-2026-55368
Am I affected You are affected if: 1. You run zebrad up to and including v4.4.1. 2. Your node accepts inbound P2P connections network.listen addr is set, which is the default. 3. Your node's mempool is active node is synced near the chain tip. All default configurations are affected. Summary The...
ALSA-2026:34911 Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: fs/smb/client: fix out-of-bounds read in cifssanitizeprepath CVE-2026-43112 kernel: rxrpc: Fix potential UAF after skbunshare failure CVE-2026-45998 kernel: drm/gem: Fix inconsistent plan...
CVE-2026-38971
ArduPilot software versions prior to Plane-4.6.4 are vulnerable to an out-of-bounds read issue. The flaw is located in the libraries/GCS_MAVLink/GCS_serial_control.cpp file within the GCS_MAVLINK::handle_serial_control() function. This vulnerability occurs when the program reads data beyond the i...
PT-2026-55471
Name of the Vulnerable Software and Affected Versions Zebra versions prior to 4.4.2 Description Zebra can accept blocks that the zcashd reference implementation rejects due to a discrepancy in how P2SH Pay-to-Script-Hash signature-operation counters handle disabled opcodes. In the...