34076 matches found
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: curl (UTSA-2026-106769)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106769 advisory. libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps...
PT-2026-88832
Improper access control in Link to Windows prior to SMR Sep-2026 Release 1 allows local attackers to establish a connection with the PC without proper user interaction...
CVE-2026-21098: Improper Access Control
Improper access control in Link to Windows prior to SMR Sep-2026 Release 1 allows local attackers to establish a connection with the PC without proper user interaction...
Linux Distros Unpatched Vulnerability : CVE-2026-82053
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user...
PT-2026-89175
Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.10.0 through 0.11.0 Description An issue exists in the knowledge base delete handler where a non-administrator user with write access to an external knowledge base can delete the shared instance configuration. This occurs...
openSUSE 16: curl / curl-fish-completion / curl-zsh-completion / libcurl-devel / etc (openSUSE-SU-2026:21774-1)
The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21774-1 advisory. - CVE-2026-5773: wrong reuse of SMB connection bsc1262633. - CVE-2026-7168: cross-proxy Digest auth state leak bsc1263440. - CVE-2026-8926:...
SUSE CVE-2026-85014
undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writable stream unconditionally and discards the returned...
EUVD-2026-69701
Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections...
EUVD-2026-70248
HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated...
HTTP Request Smuggling
Overview httpx2 is a The next generation HTTP client. Affected versions of this package are vulnerable to HTTP Request Smuggling in Request.prepare, which applies a generated Content-Length header through setdefault whenever the body size is known, without checking whether the caller has already...
GHSA-PF96-P4FJ-6566 HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated
Summary HTTPX2 can automatically add a Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header. The resulting HTTP/1.1 request contains both framing headers, which can create an ambiguous message boundary and enable request smuggling or connection...
CVE-2026-84197
In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from 2.0.0 to 3.9.0 and of its predecessor package @eclipse-ditto/ditto-javascript-client-node1.0 from 1.0.0 to 2.1.0, the WebSocket transport hard-codes rejectUnauthorized: false wh...
CVE-2026-28616
In Setup Wizard, there is a possible way to force connection to a malicious network due to confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-86673
A vulnerability was determined in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this issue is the function mysqliconnect of the file config/database.php of the component Database Connection. This manipulation causes hard-coded credentials. The...
CVE-2026-72967
Heap-based buffer overflow in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally...
CVE-2026-72966
Missing authorization in Windows Remote Access Connection Manager allows an authorized attacker to perform tampering locally...
CVE-2026-72926
Use after free in Windows Internet Connection Sharing ICS allows an authorized attacker to elevate privileges locally...
CVE-2026-71333
Use after free in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally...