CVE-2026-24733

CVE-2026-24733 CVE-2026-24733とは？ Apache Tomcatは、特定のsecurity-constraint設定において、HTTP/0.9形式のHEADリクエストを誤って処理していました。 CVE-2026-24733 防御的検証ツール CVE-2026-24733 （Apache TomcatのHTTP/0.9 HEAD security-constraintバイパス）に対応する、軽量で依存関係のないPythonセキュリティ検証ツールです。 本プロジェクトは以下の用途を想定しています： ブルーチーム SOCアナリスト 脆弱性管理チーム...

cve-2021-41773

CVE-2021-41773 – Apache Path Traversal 보고서 요약 Apache HTTP Server 2.4.49 버전에서 발견된 취약점으로, 웹 서버 설정에 따라 Path Traversal 공격을 통해 시스템의 민감한 파일을 노출할 수 있음 Path Traversal: 공격자가 ../ 을 포함한 경로를 사용하여 웹 루트 밖의 파일에 접근할 수 있음 정보 취약점 이름 : CVE-2021-41773 영향받는 버전 : Apache HTTP Server 2.4.49 취약점 유형 : Path Traversal 공식 패치...

AlmaLinux 9 : rsyslog (ALSA-2026:67583)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:67583 advisory. rsyslog: A configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd CVE-2026-19654 Tenab...

CVE-2026-11929

IBM Security Verify Identity Access Reverse Proxy in certain configurations may provide weaker than expected cryptographic validation of user supplied data...

CVE-2026-11929 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Identity Access Reverse Proxy in certain configurations may provide weaker than expected cryptographic validation of user supplied data...

Exploit for Improper Input Validation in Apache Tomcat

CVE-2026-24733 What is CVE-2026-24733? Apache Tomcat incor...

Important: Red Hat Security Advisory: rsyslog security update

An update for rsyslog is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

Missing Authorization

Overview lemur is a Certificate management and orchestration service Affected versions of this package are vulnerable to Missing Authorization in the POST /api/1/authorities process when the ADMINONLYAUTHORITYCREATION configuration is set to False. An attacker can gain unauthorized control over...

CVE-2026-45809

OpenSIPS is a Session Initiation Protocol SIP server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the watcherinfo generation functionality. An attacker can create an oversized watcher entry by sending a SUBSCRIBE Event: presence request with a...

GHSA-J9GF-VW2F-9HRW Appsmith: Configuration-dependent origin validation bypass in password reset and email verification link generation

Summary A configuration-dependent origin validation bypass was identified in Appsmith’s password reset and email verification flows on current release. Both flows derive the email-link base URL from the request Origin header. The current validation only enforces a trusted base URL when...

Linux kernel 安全漏洞

The Linux kernel is the kernel used by the Linux operating system developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the udpsockcreate6 function returning a success result without actually creating a socket under certain...

CVE-2026-0771 Langflow PythonFunction Code Injection Remote Code Execution Vulnerability

Langflow PythonFunction Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Attack vectors and exploitability will vary depending on the configuration of the product. The specific flaw exis...

CVE-2026-0771

Langflow PythonFunction Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Attack vectors and exploitability will vary depending on the configuration of the product. The specific flaw exis...

CVE-2025-22234 Spring Security - BCrypt Password Encoder maximum password length breaks timing attack mitigation

The fix applied in CVE-2025-22228 inadvertently broke the timing attack mitigation implemented in DaoAuthenticationProvider. This can allow attackers to infer valid usernames or other authentication behavior via response-time differences under certain configurations...

tomcat: Denial of Service in Tomcat

A vulnerability was found in Tomcat. Under certain configurations on any platform, this flaw allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake process...

tomcat: Denial of Service in Tomcat

A vulnerability was found in Tomcat. Under certain configurations on any platform, this flaw allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake process...

CVE-2022-0947

A vulnerability in ABB ARG600 Wireless Gateway series that could allow an attacker to exploit the vulnerability by remotely connecting to the serial port gateway, and/or protocol converter, depending on the configuration...

Apache HTTP Server Path Traversal & Remote Code Execution (CVE-2021-41773 & CVE-2021-42013)

On October 4, 2021, Apache HTTP Server Project released Security advisory on a Path traversal and File disclosure vulnerability in Apache HTTP Server 2.4.49 and 2.4.50 tracked as CVE-2021-41773 and CVE-2021-42013. In the advisory, Apache also highlighted “the issue is known to be exploited in the...

Citrix SD-WAN WANOP 10.2.x Multiple Vulnerabilities (CTX276688)

The remote Citrix SD-WAN WANOP device is version 10.2.x prior to 10.2.7, 11.0.x prior to 11.0.3d, 11.1.x prior to 11.1.1a. It is, therefore, affected by multiple vulnerabilities: - An authorization bypass vulnerability exists in Citrix SD-WAN WANOP devices. An unauthenticated, remote attacker wit...

sudo: by using ! character in the shadow file instead of a password hash can access to a run as all sudoer account

When an account is disabled via the shadow file, by replacing the password hash with "!", it is not considered disabled by sudo. And depending on the configuration, sudo can be run by using such disabled account...