6173 matches found
Important: Red Hat Security Advisory: postgresql-jdbc security update
An update for postgresql-jdbc is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common...
jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication
A flaw was found in pgjdbc, an open-source PostgreSQL JDBC Driver. A malicious server can exploit this vulnerability by instructing the driver to perform SCRAM-SHA-256 Salted Challenge Response Authentication Mechanism Secure Hash Algorithm 256 authentication with an excessively large iteration...
RHEL 8 : postgresql-jdbc (RHSA-2026:59277)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:59277 advisory. PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs...
The vulnerability of the smb2_unlink() function in the fs/smb/client/smb2inode.c file of the Smb file system in the Linux operating system allows a hacker to cause a service failure.
The vulnerability of the smb2unlink function in the fs/smb/client/smb2inode.c file of the Smb file system in the Linux operating system is related to the access to an uninitialized pointer. Exploiting this vulnerability could allow a attacker to cause a service failure...
PT-2026-81849
Name of the Vulnerable Software and Affected Versions ORAS CLI versions prior to 1.3.3 Description Recursive referrer traversal fails to track visited descriptors, allowing a malicious OCI registry to return a cyclic referrer graph. This leads to unbounded recursion and memory growth, resulting i...
RHEL 8 : postgresql-jdbc (RHSA-2026:59278)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:59278 advisory. PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs...
awxkit: path traversal via YAML !include directive
A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.form...
awxkit: path traversal via YAML !include directive
A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.form...
awxkit: path traversal via YAML !include directive
A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.form...
PT-2026-81048
Name of the Vulnerable Software and Affected Versions Boost versions prior to 2.0.5 Description An unauthenticated Cross-Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the context of a user's session without requiring prior authentication. Recommendation...
dompurify: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset
A flaw was found in DOMPurify where the clearConfig function does not properly reset the retained Trusted Types policy. This can lead to a DOMPurify instance, when reused across different security contexts, remaining bound to a previously supplied and potentially unsafe policy. An attacker could...
dompurify: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset
A flaw was found in DOMPurify where the clearConfig function does not properly reset the retained Trusted Types policy. This can lead to a DOMPurify instance, when reused across different security contexts, remaining bound to a previously supplied and potentially unsafe policy. An attacker could...
html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping
A flaw was found in html/template. A trusted template author could craft a script tag with an empty or whitespace-only 'type' attribute. This vulnerability causes the template engine to incorrectly escape data passed into the script block, potentially leading to cross-site scripting XSS. An...
CVE-2026-77080 n8n before 1.123.69 Arbitrary File Read and Write via Snowflake
n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an arbitrary file read and write vulnerability in the Snowflake node, which passes free-form Execute Query input, including client-side commands, directly to the Snowflake SDK without applying n8n's file-access restrictions...
PT-2026-79088
An issue was discovered in vsDesk v14.0101. An authenticated attacker with administrative privileges can bypass client-side file validation in the "Import via CSV" component due to a lack of server-side validation. This allows the upload of an arbitrary file, which can lead to Remote Code Executi...
CVE-2026-59992
creationtimestamp| type| source ---|---|--- 2026-08-19 22:35:05+00:00| published-proof-of-concept| https://github.com/tinacms/tinacms/security/advisories/GHSA-8mq9-5fw2-5rm4...
UBUNTU-CVE-2026-63652
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, rdpsndserverrecvformats in channels/rdpsnd/server/rdpsndmain.c frees context-clientformats on a malformed Client Audio Formats PDU without clearing the owning pointer or numclientformats. An authenticated RDP client...
ANT-2026-AM0R21ZY · supabase/supabase · broken-access-control
broken-access-control medium Severity Claude medium · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-AM0R21ZY: HIPAA sensitive-project AI block enforced only client-side The client hook...
BIT-JAVA-MIN-2026-60164
Vulnerability in Oracle Java SE component: JavaFX. The supported version that is affected is Oracle Java SE: 8u491. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks require human...