557 matches found
CVE-2025-69581
CVE-2025-69581 An issue was discovered in Chamillo LMS 1.11.2. The Social Network /personaldata endpoint exposes full sensitive user information even after logout because proper cache-control is missing. Using the browser back button restores all personal data, allowing unauthorized users on the...
qt6-qtbase security update
An update is available for qt6-qtbase. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Qt is a software toolkit for developing applications. This package contai...
RLSA-2026:98636 Important: qt6-qtbase security update
Qt is a software toolkit for developing applications. This package contains base tools, like string, xml, and network handling. Security Fixes: qt5-qtbase: qt6-qtbase: qt: Denial of Service via excessively large HTTP Cache-Control header CVE-2026-76151 qt: qt: Denial of Service via crafted XML...
CVE-2026-126084
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, when a GCS service is configured with the cachecontrol option, ActiveStorage::Service::GCSServiceurlfordirectupload signs direct-upload URL...
qt5-qtbase: qt6-qtbase: qt: Denial of Service via excessively large HTTP Cache-Control header
A flaw was found in the QtNetwork module of the Qt Framework. This out-of-bounds read vulnerability allows a remote attacker to cause a denial of service application crash. This occurs when an application using QNetworkAccessManager processes an excessively large HTTP Cache-Control header value...
Important: Red Hat Security Advisory: qt6-qtbase security update
An update for qt6-qtbase is now available for Red Hat Enterprise Linux 10.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...
Important: Red Hat Security Advisory: qt6-qtbase security update
An update for qt6-qtbase is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...
qt5-qtbase: qt6-qtbase: qt: Denial of Service via excessively large HTTP Cache-Control header
A flaw was found in the QtNetwork module of the Qt Framework. This out-of-bounds read vulnerability allows a remote attacker to cause a denial of service application crash. This occurs when an application using QNetworkAccessManager processes an excessively large HTTP Cache-Control header value...
undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives
A flaw was found in undici. This vulnerability allows for cross-user information disclosure when malformed Cache-Control private directives cause private response bodies and headers, such as Set-Cookie data, to be stored in a shared cache and subsequently exposed to other users. Additionally, a...
RHEL 10 : qt6-qtbase (RHSA-2026:99155)
The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:99155 advisory. Qt is a software toolkit for developing applications. This package contains base tools, like string, xml, and network handling. Security...
RHEL 10 : qt6-qtbase (RHSA-2026:98636)
The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:98636 advisory. Qt is a software toolkit for developing applications. This package contains base tools, like string, xml, and network handling. Security...
undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives
A flaw was found in undici. This vulnerability allows for cross-user information disclosure when malformed Cache-Control private directives cause private response bodies and headers, such as Set-Cookie data, to be stored in a shared cache and subsequently exposed to other users. Additionally, a...
PT-2026-144760
Name of the Vulnerable Software and Affected Versions Active Storage versions prior to 8.1.4.1 Active Storage versions prior to 8.0.5.2 Description When a GCS service is configured with the cache control option, the url for direct upload function in ActiveStorage::Service::GCSService signs...
OESA-2026-4722 qt6-qtbase security update
Qt is a software toolkit for developing applications. Security Fixes: QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.CVE-2026-19248 Out-of-bounds read buffer over-read in the HTTP Cache-Control response header parsing in th...
CLEANSTART-2026-MB00933 undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive
Security vulnerability affects the langfuse-worker package. undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive...
CLEANSTART-2026-NE99679 undici's cache interceptor mishandles malformed Cache-Control private directives
Security vulnerability affects the langfuse-worker package. undici's cache interceptor mishandles malformed Cache-Control private directives...
CLEANSTART-2026-IU46209 undici's cache interceptor mishandles malformed Cache-Control private directives
Security vulnerability affects the langfuse package. undici's cache interceptor mishandles malformed Cache-Control private directives...
CVE-2026-118571
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Media Alias Display versions: from 0.0.0 to 2.1.3, from 3.0.0 to 3.0.3...
Symfony and Symfony HTTP Foundation Component 4.1.x < 5.4.54 / 6.0.x < 6.4.46 / 7.0.x < 7.4.19 / 8.0.x < 8.1.7 DoS
The version of Symfony and/or the Symfony HTTP Foundation Component installed on the remote host is 4.1.0 or later prior to 5.4.54, or 6.0.0 or later prior to 6.4.46, or 7.0.x prior to 7.4.19, or 8.0.x prior to 8.1.7. It is, therefore, affected by a denial of service vulnerability. -...
DRUPAL-CONTRIB-2026-292
This module allows for direct viewing of a file with the URL alias. This is a followup advisory to SA-CONTRIB-2026-245, which did not fully resolve the underlying vulnerability. In some cases, files may be served with the HTTP header Cache-Control: public when they should be uncacheable. This can...