133512 matches found
Important: perl-Net-DNS
Issue Overview: Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDEDERROR::decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option RFC 8914 by tokenising the raw bytes and passing the result to Perl's eval...
PT-2026-73416
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, in OpenBao's Kerberos auth method on the GET handler, or when an Authorization: Negotiate header is supplied, the response is includes a logical.Auth object in addition to an error message. This results in...
CVE-2026-67919
An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, installFromUri method, and DefaultPluginApplicationContextFactory components...
CVE-2026-67919
An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, installFromUri method, and DefaultPluginApplicationContextFactory components...
Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100733)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100733 advisory. In the Linux kernel, the following vulnerability has been resolved: ipvs: clear the svc scheduler ptr early on edit ipvseditservice while unbinding the old scheduler...
Unity Linux 20.1070e Security Update: mtr (UTSA-2026-099537)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099537 advisory. mtr is vulnerable to Out-of-bound read vulnerability in ipinfolookup function. An attacker who can influence the TXT response used for AS lookups can trigger this bu...
Unity Linux 20.1070e Security Update: pam (UTSA-2026-099450)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099450 advisory. Linux-PAM through 1.7.2 contains an observable timing discrepancy CWE-208 in the pamuserdb module's plaintext-password comparison path in modules/pamuserdb/pamuserdb...
Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100719)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100719 advisory. In the Linux kernel, the following vulnerability has been resolved: pppoe: drop PFC frames RFC 2516 Section 7 states that Protocol Field Compression PFC is NOT...
webpack_devserver 5.2.5 - CSRF
Exploit Title: webpackdevserver 5.2.5 - Csrf Date: 2026-07-17 Exploit Author: Pig-Tail Jorge González Milla Vendor Homepage: https://github.com/webpack/webpack-dev-server Software Link: https://www.npmjs.com/package/webpack-dev-server Version: reaches launchEditorfileName from a CROSS-ORIGIN...
PT-2026-73393
Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted...
About the security content of iOS 26.6.1 and iPadOS 26.6.1
About the security content of iOS 26.6.1 and iPadOS 26.6.1 This update delivers security fixes that were first made available in the iOS 27 and iPadOS 27 betas. This document describes the security content of iOS 26.6.1 and iPadOS 26.6.1. About Apple security updates For our customers' protection...
Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099693)
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099693 advisory. In the Linux kernel, the following vulnerability has been resolved: net: afkey: initialize algkeylen for IPComp states pfkeymsg2xfrmstate handles the IPComp...
Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100535)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100535 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: qat - remove unused character device and IOCTLs The QAT driver exposes a character device...
Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100548)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100548 advisory. In the Linux kernel, the following vulnerability has been resolved: net/sched: clsfw: fix NULL dereference of old filters before change Like pointed out by Sashiko 1...
Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100355)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100355 advisory. In the Linux kernel, the following vulnerability has been resolved: hfs: fix slab-out-of-bounds in hfsbnoderead This patch introduces isbnodeoffsetvalid method that...
Linux Distros Unpatched Vulnerability : CVE-2026-19967
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security flaw has been discovered in Open Asset Import Library Assimp 17c12da. Impacted is the function Assimp::Compression::decompressBlock of the file...
PT-2026-76678
UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /create project endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may ...
PT-2026-76679
UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /add prompts endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may be...
PT-2026-76620
openssl encrypt versions before 1.4.0 contain a path traversal vulnerability in the is safe path method where the plugin id parameter is not sanitized before constructing the plugin config directory path. Attackers can declare a malicious plugin id containing path traversal sequences like '../' t...
