278267 matches found
Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix
A flaw was found in Apache Tomcat. This improper input validation vulnerability stems from an incomplete fix for a previous security issue CVE-2025-66614. This flaw may allow an attacker to bypass security controls or cause unexpected behavior within the application...
BIT-ENVOY-GATEWAY-2026-53717 Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar header
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, internal/wasm/imagefetcher.go follows tenant-controlled EnvoyExtensionPolicy spec.wasm.code.image.url values to Docker or OCI Wasm layers, and...
Malicious code in @asenfotech/unplugin-element-plus (npm)
Source: amazon-inspector 458bff9dc8d1f808d642b767ca08ca89253919bbf0d7fd2890b95f3b9c156926 Package presents itself as an Element Plus resolver for Vue tooling: index.js is a 25-line ElementPlusResolver stub. The bulk of the tarball under lib/gradle/ implements an install-time and import-time...
libsoup: SoupWebsocketConnection: libsoup: WebSocket remote denial of service via oversized control frame protocol violation
A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 §5.5, which mandates that all WebSocket control frames e.g., PING, PONG, CLOSE contain a payload of 125 bytes or less. A remote, unauthenticated attacker...
ROS-20260921-73-0123
The vulnerability in Xen is related to insufficient resource control during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...
ROS-20260921-73-0054
The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...
PT-2026-96051
Name of the Vulnerable Software and Affected Versions Omega Solution HRM OS versions prior to 20260717 Description An issue exists in the Role Permission Retrieval Endpoint within the /role-permission/permission file. Remote manipulation of the roleId argument allows for improper control of...
ROS-20260921-73-0055
The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...
Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS : Rclone vulnerability (USN-8782-1)
The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8782-1 advisory. It was discovered that Rclone incorrectly handled unauthenticated requests to the remote...
CVE-2026-79319
Stencil core 4.43.5 is vulnerable to Incorrect Access Control...
PT-2026-96243
Name of the Vulnerable Software and Affected Versions Stencil core version 4.43.5 Description Incorrect Access Control allows unauthorized users to access restricted resources or perform actions they are not permitted to execute. Recommendations At the moment, there is no information about a newe...
PT-2026-96036
Name of the Vulnerable Software and Affected Versions Hangzhou Shunwang Technology shzh version 10.7.2.693 Description A local issue exists within the IRP MJ DEVICE CONTROL Handler component in the shdrv x64.sys file. Specifically, the sub 180004AC0 function does not properly handle the PID...
PT-2026-96161
Name of the Vulnerable Software and Affected Versions Tinyauth versions prior to 5.1.2 Description Tinyauth performs case-sensitive comparisons of forwarded hostnames, whereas reverse proxies typically route equivalent hostnames case-insensitively. This discrepancy allows an authenticated user wi...
CVE-2026-77165: Improper Access Control
File owners were unable to unlock TYPETOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database...
CVE-2026-94571: Improper Control of Generation of Code
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirecturl and redirectprefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, and thus newlines passed structural checks, but Octavia stored...
ROS-20260921-73-0076
The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...
ROS-20260921-73-0064
The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...
ROS-20260921-73-0059
The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...