31750 matches found
CVE-2026-64289
CVE-2026-64289 affects the Linux kernel in the iommufd path, where iommufd_hwpt_invalidate() accepts user-controlled entry_num and entry_len. The description and connected details specify that entry_len can exceed the kernel struct size and trigger zero-check scans over excess bytes, while large ...
CVE-2026-64289 iommufd: Set upper bounds on cache invalidation entry_num and entry_len
In the Linux kernel, the following vulnerability has been resolved: iommufd: Set upper bounds on cache invalidation entrynum and entrylen iommufdhwptinvalidate takes a user-controlled entrynum and entrylen, each bounded only by U32MAX. An entrylen beyond the kernel's struct size makes the copy...
Cache poisoning possible with label count discrepancy, RRSIG, and wildcards
...
Cache Confusion
Next.js is vulnerable to Cache Confusion. The vulnerability is due to improper caching of server-side fetch responses, where cached response bodies may be reused across requests with different request bodies, allowing confidential data from one request to be exposed to unauthorized users...
Sensitive Information Exposure
Next.js is vulnerable to Sensitive Information Exposure. The vulnerability is due to improper caching of server-side fetch responses for non-UTF-8 request bodies, where different request bodies can share the same cache entry, allowing confidential response data to be exposed to unauthorized...
PT-2026-64651
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists where the ntb epf vec isr function calls pci irq vector within a hardirq context to determine the vector number. Because pci irq vector subsequently calls msi get virq,...
PT-2026-64510
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The iommufd hwpt invalidate function fails to properly validate user-controlled entry num and entry len variables, which are only bounded by U32 MAX. A multi-gigabyte entry len can force...
Linux Distros Unpatched Vulnerability : CVE-2026-46582
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of data, could be briefly considered DNSSEC secure based...
Linux Distros Unpatched Vulnerability : CVE-2026-50251
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In NLnet Labs Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' is enabled set to any value greater than zero, glue records of...
Fedora 43 : sssd (2026-9ab663dcd4)
The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-9ab663dcd4 advisory. CVE fixes: CVE-2026-12610 CVE-2026-14474 CVE-2026-14476 - rhbz2494777: CVE-2026-12610 sssd: Use-after-free crash in SSSD' 'sssdpam' process -...
Linux Distros Unpatched Vulnerability : CVE-2026-44690
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198...
Linux Distros Unpatched Vulnerability : CVE-2026-11721
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. Thi...
openSUSE 16: libshibsp-lite12 / libshibsp12 / shibboleth-sp / etc (openSUSE-SU-2026:21418-1)
The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21418-1 advisory. This update for shibboleth-sp fixes the following issue - CVE-2025-9943: SQL injection in the ID attribute of the SAML response when the replay cache of...
Linux Distros Unpatched Vulnerability : CVE-2026-50252
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS...
GHSA-FP43-VJ7G-PG92 OmniFaces: Forged combined-resource IDs and related output/push boundaries
Forged combined-resource IDs CombinedResourceInfo accepts a path-derived ID without an authenticity check, inflates it without an output limit, converts it to attacker-selected resource identifiers, and retains unique IDs in an unbounded static cache. In bounded tests, 20,754 encoded bytes...
OmniFaces: Forged combined-resource IDs and related output/push boundaries
Forged combined-resource IDs CombinedResourceInfo accepts a path-derived ID without an authenticity check, inflates it without an output limit, converts it to attacker-selected resource identifiers, and retains unique IDs in an unbounded static cache. In bounded tests, 20,754 encoded bytes...
GHSA-MHVJ-JHPQ-885V blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser
Summary Five independent HTTP/1.1 conformance laxities in blaze's hand-written Java parser http/src/main/java/org/http4s/blaze/http/parser/ cause request-boundary disagreement with a stricter intermediary. All are reachable from a default BlazeServerBuilder with no non-default configuration. Impa...
GHSA-GH4H-34GR-87R7 Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders
Summary When an SSO-authenticated user tests an automation in the Budibase builder, their OAuth2 access token and refresh token are included in the automation test results. These results are broadcast via WebSocket to all builders connected to the same dev app and stored in an in-memory cache...
Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders
Summary When an SSO-authenticated user tests an automation in the Budibase builder, their OAuth2 access token and refresh token are included in the automation test results. These results are broadcast via WebSocket to all builders connected to the same dev app and stored in an in-memory cache...