20366 matches found
SUSE CVE-2026-75595
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandlerdecode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause...
PT-2026-81131
Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing...
PT-2026-81455
Name of the Vulnerable Software and Affected Versions Adobe Campaign Classic affected versions not specified Description Adobe Campaign Classic is affected by a Server-Side Request Forgery SSRF issue, which occurs when a server is tricked into making requests to an unintended location. This flaw...
PT-2026-81457
Name of the Vulnerable Software and Affected Versions Adobe Campaign Classic affected versions not specified Description An Improper Neutralization of Special Elements used in an OS Command occurs, leading to an OS Command Injection. This allows an attacker to execute arbitrary code in the contex...
PT-2026-81491
A Content Security Policy bypass was addressed with improved enforcement in AudioWorklet contexts. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5. Processing maliciously crafted web content may bypass Content Security Policy...
Security Bulletin: Langflow is affected by security vulnerabilities in Model Context Protocol features
Summary Langflow uses Model Context Protocol MCP features to manage external server connections, project access, file resources, and local client integration. Weaknesses in MCP command and configuration validation, authentication and authorization enforcement, file resource handling, and request...
CVE-2026-59567
Multiple vulnerabilities on affected versions of Zscaler Client Connector allow local privilege escalation, giving an unprivileged user the ability to execute arbitrary code in a privileged context...
CVE-2026-59568
Multiple vulnerabilities on affected versions of Zscaler Client Connector allow remote code execution, giving an unauthenticated, unprivileged user the ability to execute arbitrary code in the ZCC context...
CVE-2026-59568 Remote Code Execution
Multiple vulnerabilities on affected versions of Zscaler Client Connector allow remote code execution, giving an unauthenticated, unprivileged user the ability to execute arbitrary code in the ZCC context...
EUVD-2026-64884
Multiple vulnerabilities on affected versions of Zscaler Client Connector allow remote code execution, giving an unauthenticated, unprivileged user the ability to execute arbitrary code in the ZCC context...
EUVD-2026-64883
Multiple vulnerabilities on affected versions of Zscaler Client Connector allow local privilege escalation, giving an unprivileged user the ability to execute arbitrary code in a privileged context...
CVE-2026-59567
Zscaler Client Connector is affected by multiple local privilege escalation vulnerabilities that allow an unprivileged user to execute arbitrary code in a privileged context . The CVSS 3.1 score is 8.8 (HIGH) , with a local attack vector, low complexity, low privileges required, no user interacti...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: drivers/perf: hisi: Do not migrate perf to the CPU that is going to be torned down. The driver needs to migrate the perf context if the currently used CPU is going to be torned down. By the time the cpuhp::teardown callback is...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: octeontx2-pf: Fixed the use of GFPKERNEL in atomic contexts for rt. The commit 4af1b64f80fb “octeontx2-pf: Fixed the lmtst ID used in aurafree” uses get/putcpu to protect the usage of percpu pointers in the -aurafreeptr...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Avoid using GFPKERNEL in an atomic context. Using GFPKERNEL in a preemption-disabled context may cause the following warning when CONFIGDEBUGATOMICSLEEP is enabled. 32.542271 BUG: A sleeping function was called from...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: uprobes/x86: Proper mmstruct should be used in inuprobetrampoline. In the unregistered path, we use inuprobetrampoline to check the VMA lookup using current-mm, which is incorrect. This is because we are in the tracer context, no...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock. Since DMAfence objects can be shared with other subsystems, they may be accessed from the hardirq context in those drivers. We must take that into accoun...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: iouring/bpf-ops: Rejection of re-registration of an already-bound ops. The ioinstallbpf function only rejects a second registration on the ctx-bpfops side and unconditionally sets the per-map back-pointer ops-priv. The structops...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clearing the Present bit before tearing down the scalable-mode context entry The devicepasidtableteardown function zeros the 128-bit scalable-mode context entry using contextclearentry, even when the Present bit is...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: always put unsuccessfully committed target pids damoncommittarget puts and gets the destination and the source target pids. It puts the destination target pid because it will be overwritten by the source target pid...