34076 matches found
net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...
EUVD-2026-73965
In Setup Wizard, there is a possible way to force connection to a malicious network due to confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-86673 ningzichun Student Management System Database Connection database.php mysqli_connect hard-coded credentials
A vulnerability was determined in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this issue is the function mysqliconnect of the file config/database.php of the component Database Connection. This manipulation causes hard-coded credentials. The...
CVE-2026-86673 ningzichun Student Management System Database Connection database.php mysqli_connect hard-coded credentials
A vulnerability was determined in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this issue is the function mysqliconnect of the file config/database.php of the component Database Connection. This manipulation causes hard-coded credentials. The...
CVE-2026-86673 ningzichun Student Management System Database Connection database.php mysqli_connect hard-coded credentials
A vulnerability was determined in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this issue is the function mysqliconnect of the file config/database.php of the component Database Connection. This manipulation causes hard-coded credentials. The...
EUVD-2026-74045
A vulnerability was determined in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this issue is the function mysqliconnect of the file config/database.php of the component Database Connection. This manipulation causes hard-coded credentials. The...
USN-8670-3: curl vulnerability
USN-8670-1 fixed a vulnerability in curl. This update provides the corresponding update for Ubuntu 26.04 LTS. Original advisory details: Joshua Rogers discovered that curl incorrectly handled reusing connections when client certificate settings changed. This could result in the wrong client...
USN-8670-3 curl vulnerability
USN-8670-1 fixed a vulnerability in curl. This update provides the corresponding update for Ubuntu 26.04 LTS. Original advisory details: Joshua Rogers discovered that curl incorrectly handled reusing connections when client certificate settings changed. This could result in the wrong client...
CVE-2026-82075
An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. A client that has network access to a router port and has not authenticated can supply connection-monitoring parameters that cause the server to expend CPU resources...
CVE-2026-79570
mfish-nocode-pro v1.0.0 was discovered to contain a SQL injection vulnerability in the tableName parameter at /sys/dbConnect/data. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...
CVE-2026-72966
CVE-2026-72966 affects Windows Remote Access Connection Manager , where a missing authorization check allows an already-authorized (low-privilege) local attacker to perform tampering without user interaction. The impact is rated HIGH for integrity with no effect on confidentiality or availability...
EUVD-2026-73679
Heap-based buffer overflow in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally...
CVE-2026-72967
A heap-based buffer overflow in the Windows Network Connection Broker component allows an authorized low-privilege attacker to escalate privileges locally. The vulnerability carries a CVSS 3.1 score of 7.8 (HIGH) with a local attack vector, low complexity, no user interaction, and high impact on ...
CVE-2026-72964
CVE-2026-72964 is a missing authentication vulnerability in Windows Internet Connection Sharing (ICS) . An attacker with low-level local privileges can tamper with critical ICS functions, resulting in a high integrity impact without affecting confidentiality or availability. The CVSS 3.1 score is...
CVE-2026-69331
CVE-2026-69331 is a use-after-free vulnerability in Windows Remote Access Connection Manager that allows an authorized local attacker to elevate privileges . The vulnerability is rated HIGH (CVSS 3.1: 7.0) with a local attack vector , high complexity , and low privileges required . No user intera...
CVE-2026-68886
CVE-2026-68886 is a use-after-free vulnerability in the Windows Network Connection Broker component. An authorized local attacker can exploit it to disclose information , with high confidentiality impact and no integrity or availability impact (CVSS 3.1: 5.5 MEDIUM , vector AV:L/AC:L/PR:L/UI:N/S:...
EUVD-2026-73416
Use after free in Windows Network Connection Broker allows an authorized attacker to disclose information locally...
EUVD-2026-73256
Use after free in Windows Internet Connection Sharing ICS allows an unauthorized attacker to execute code over a network...
CVE-2026-72983
CVE-2026-72983 is a use-after-free vulnerability in Windows Internet Connection Sharing (ICS) that allows an unauthorized remote attacker to achieve remote code execution over the network. The CVSS 3.1 score is 9.8 (Critical) with no privileges or user interaction required. CISA's SSVC assessment...