266160 matches found
TYPO3-EXT-SA-2026-035: Broken Access Control in extension "TYPO3 AI Integration Extension" (ns_t3ai)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-035...
TYPO3-EXT-SA-2026-031: Broken Access Control in extension "Analytics" (analytics)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-031...
TYPO3-EXT-SA-2026-033: Broken Access Control in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-033...
TYPO3-EXT-SA-2026-028: Broken Access Control in extension "FAL Protect" (fal_protect)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-028...
TYPO3-EXT-SA-2026-036: Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-036...
TYPO3-EXT-SA-2026-036: Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-036...
WordPress ACF Extended plugin <= 0.9.2.7 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Peter Tang in WordPress Plugin ACF Extended versions = 0.9.2.7...
CVE-2026-98584
A flaw was found in the Linux kernel's network traffic control subsystem. A local user can exploit this vulnerability to cause an information disclosure of kernel stack data. When dumping text search filter configurations, the kernel fails to initialize a stack structure before copying it into...
CVE-2023-35794-WebSSH-Hijacking
CVE-2023-35794-WebSSH-Hijacking Repository contains description for CVE-2023-35794 discovered by Dodge Industrial Team for Dodge OPTIFY platfrom. CVE ID: CVE-2023-35794 Vendor: Cassia Networks Product: Access Controller Version: Cassia-AC-2.1.1.2303271039 Vulnerability: Incorrect Access Control...
Oracle WebLogic Server - Remote Command Execution
Oracle WebLogic Server 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0 is susceptible to remote code execution. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised machine without entering necessary credentials. See...
CVE-2026-105298
Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI session.reqheader.uri saw the :authority value, but the upstream received the client-supplied Host value...
CVE-2026-105298 Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass
Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI session.reqheader.uri saw the :authority value, but the upstream received the client-supplied Host value...
CVE-2026-105298 Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass
Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI session.reqheader.uri saw the :authority value, but the upstream received the client-supplied Host value...
EUVD-2026-104695
Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI session.reqheader.uri saw the :authority value, but the upstream received the client-supplied Host value...
CVE-2026-105298
Versions of Pingora prior to 0.9.0 are vulnerable to a security issue where the software accepts HTTP/2 requests with a Host header that differs from the :authority pseudo-header. The root cause involves the server failing to compare these values or reject userinfo in the authority, violating RFC...
CVE-2026-105298
Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI session.reqheader.uri saw the :authority value, but the upstream received the client-supplied Host value...
CLEANSTART-2026-NF66444 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...
CVE-2026-78663 affects multiple packages. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. See references f...
Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2024-56657)
In the Linux kernel, the following vulnerability has been resolved: ALSA: control: Avoid WARN for symlink errors Using WARN for showing the error of symlink creations don't give more information than telling that something goes wrong, since the usual code path is a lregister callback from each...
PT-2026-119408
Name of the Vulnerable Software and Affected Versions Oracle Primavera Unifier versions 23.12.0 through 23.12.16 Description A flaw in the Project Control component allows a low privileged attacker with network access via HTTP to compromise the system. This can lead to unauthorized read access to...
PT-2026-118826
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description Improper access control in Extensions allows a remote attacker to potentially leak sensitive information through the use of a crafted HTML page. Recommendations Update Google Chrome to...