CVE-2026-20031

A vulnerability in the HTML Cascading Style Sheets CSS module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper error handling when splitting UTF-8 strings. An attacker could exploit th...

GHSA-92MV-8F8W-WQ52 traefik CVE-2024-45410 fix bypass: lowercase `Connection` tokens can delete traefik-managed forwarded identity headers (for example, `X-Real-Ip`)

Impact There is a potential vulnerability in Traefik managing the Connection header with X-Forwarded headers. When Traefik processes HTTP/1.1 requests, the protection put in place to prevent the removal of Traefik-managed X-Forwarded headers such as X-Real-Ip, X-Forwarded-Host, X-Forwarded-Port,...

DEBIAN-CVE-2026-3544

Heap buffer overflow in WebCodecs in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. Chromium security severity: High...

CVE-2026-28784

creationtimestamp| type| source ---|---|--- 2026-03-04 18:18:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgavfpvob72o...

CVE-2026-2732

creationtimestamp| type| source ---|---|--- 2026-03-04 08:28:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mg7uhxfu6k2e...

SUSE CVE-2026-25889

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to 2.57.1, a case-sensitivity flaw in the password validation logic allows any authenticated user to change their password or an admin to change...

Qinglong-Auth-bypass-to-RCE-poc

Qinglong Auth Bypass to Command Execution A proof-of-concept...

CVE-2026-1487

creationtimestamp| type| source ---|---|--- 2026-03-03 04:25:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mg4wfv7qk72o...

📄 libvips 8.19.0 VIPS Image Extraction Crash / Auditor

This Python script performs a comprehensive security and stability audit of the vips image processing binary. It tests the extractarea function using extreme int32 and uint32 values as well as normal ranges to detect crashes, memory corruption, or buffer overflows. The audit automates setup,...

libpng: LIBPNG has a heap buffer overflow in png_set_quantize

A heap based buffer overflow flaw has been discovered in LibPNG. Prior to version 1.6.55, an out-of-bounds read vulnerability exists in the pngsetquantize API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported b...

CVE-2026-24113

creationtimestamp| type| source ---|---|--- 2026-03-02 16:12:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mg3ngqnnyq2d...

Samsung TVs stop spying on viewers in Texas. Here’s how to disable ACR anywhere

Samsung has settled a lawsuit with the Texas Attorney General over how its smart TVs collect and monetize viewing data using Automated Content Recognition ACR. As part of the settlement, Samsung agreed to stop collecting ACR data from Texans without explicit, informed consent and to rewrite its...

Security Bulletin: Multiple vulnerabilites in IBM Rational Build Forge.

Summary IBM Rational Build Forge 8.0.0.29 addresses multiple vulnerabilites Vulnerability Details CVEID:CVE-2025-58754 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. When Axios starting in version 0.28.0 and prior to versions 0.30.2 and 1.12.0 runs on Node.js and i...

Apache Shiro Authentication Bypass Vulnerability

Apache Shiro is the United States Apache Apache Foundation set of Java security framework for performing authentication, authorization, encryption and session management . An authentication bypass vulnerability exists in Apache Shiro versions prior to 2.0.7. The vulnerability stems from an...

PT-2026-36155

Name of the Vulnerable Software and Affected Versions gnutls affected versions not specified Description A flaw exists where case-sensitive comparisons are performed on nameConstraints labels, specifically for dNSName DNS or rfc822Name email constraints within excludedSubtrees or permittedSubtree...

Linux Distros Unpatched Vulnerability : CVE-2026-27588

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP host request matcher is documented as case-insensitive, b...

CVE-2026-27581

Further research determined the situation described is not a vulnerability...

CVE-2026-27201

Further research determined the situation described is not a vulnerability...

CVE-2026-28372

creationtimestamp| type| source ---|---|--- 2026-02-27 17:10:28+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mfu7c6ijjb2z 2026-03-02 07:10:32+00:00| seen| https://gist.github.com/alon710/e03d04f1cd72c0b9caeca59fc12c90ff 2026-03-02 16:20:10+00:00| seen|...

Improper Handling of Case Sensitivity

Overview @whyour/qinglong is a Timed task management platform supporting Python3, JavaScript, Shell, Typescript Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity. due to the case-sensitive string matching in authentication middleware. A remote attacker can...