LiteLLM - SQL Injection

LiteLLM 1.81.16 to 1.83.7 contains a SQL injection caused by improper handling of caller-supplied key in database query during proxy API key checks, letting unauthenticated attackers read and modify database data, exploit requires crafted Authorization header. id: CVE-2026-42208 info: name: LiteL...

cve-2020-9375

CVE-2020-9375 TP-Link Archer C50 V3 デバイス（Build 200318 Rel. 62209 より前）には、予期しない Referer フィールドを含む巧妙に細工された HTTP ヘッダーにより、リモート攻撃者がサービス拒否（DoS）を引き起こすことができる脆弱性があります。 エクスプロイトタイトル : TP-Link Archer C50 v3 サービス拒否 日付 : 25-01-2020 エクスプロイト作者 : thewhiteh4t ベンダーホームページ : https://www.tp-link.com/ バージョン : TP-Link...

CVE-2017-5638

CVE-2017-5638 目次 1. 概要 2. 依存関係 3. 使用方法 概要 このプロジェクトは、Apache Strutsの脆弱性の概念実証です。 目的は、上記の脆弱性に対してランダムなIPアドレスを生成しテストするソフトウェアを作成することでした。 このプロジェクトは自己責任かつ教育目的でのみ使用してください。 依存関係 cURL cURLは、特定のIPアドレスとポートに細工されたヘッダーを送信するために使用されます。 Nmap Nmapは、ポート80または443が開いているランダムなIPアドレスを生成するために使用されます。 使用方法...

RockyLinux 8 : gstreamer1-plugins-base (RLSA-2026:67145)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:67145 advisory. gstreamer1-plugins-base: gstreamer: NULL/invalid-pointer dereference in gstrtspmessageparseauthcredentials when parsing a crafted Digest...

Astra Linux – Vulnerability in Golang-1.15

In versions of Go prior to 1.15.13 and 1.16.x prior to 1.16.5, a crafted file count present in the archive’s header can lead to a panic in NewReader or OpenReader...

Moderate: Red Hat Security Advisory: gstreamer1-plugins-base security update

An update for gstreamer1-plugins-base is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Moderate: gstreamer1-plugins-base security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins. Security Fixes: gstreamer1-plugins-base: gstreamer: NULL/invalid-pointer dereference in...

ALSA-2026:67145 Moderate: gstreamer1-plugins-base security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins. Security Fixes: gstreamer1-plugins-base: gstreamer: NULL/invalid-pointer dereference in...

ALSA-2026:66460 Moderate: gstreamer1-plugins-base security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins. Security Fixes: gstreamer1-plugins-base: gstreamer: NULL/invalid-pointer dereference in...

RHCOS 4 : OpenShift Container Platform 4.22.13 (RHSA-2026:63091)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:63091 advisory. - net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGSMAXFRAMESIZE frame...

CVE-2026-84640 One byte overflow read in mail parser

A maliciously constructed mail header could lead to a one byte read past the end of a buffer. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2...

ALPINE-CVE-2026-40014

An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the size of the message. When a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for IMAP. Monitor...

EUVD-2026-67664

An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the size of the message. When a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for IMAP. Monitor...

CVE-2026-40014

An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the size of the message. When a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for IMAP. Monitor...

CVE-2026-15587

Improper Privilege Management in Google SecOps Chronicle SOAR versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to escalate privileges to system-level administrative access using a crafted internal authentication header. This vulnerability was patched with version...

CVE-2026-15587

CVE-2026-15587 affects Google SecOps (Chronicle SOAR) prior to version 6.3.85 on Google Cloud Platform. An authenticated attacker could escalate to system-level admin via a crafted internal authentication header. The issue is mitigated by upgrading to 6.3.85; Google notes no customer action is re...

CVE-2026-15587 Privilege Escalation in Google SecOps (Chronicle SOAR) via Crafted Authentication Header

Improper Privilege Management in Google SecOps Chronicle SOAR versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to escalate privileges to system-level administrative access using a crafted internal authentication header. This vulnerability was patched with version...

EUVD-2026-53390

Improper Privilege Management in Google SecOps Chronicle SOAR versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to escalate privileges to system-level administrative access using a crafted internal authentication header. This vulnerability was patched with version...

CVE-2026-54368

CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx and SearchExUnder that allows authenticated attackers to execute arbitrary SQL statements by supplying a crafted x-glad-filter request header through the jsondir API endpoint. Attackers can exploit unsanitized...

CVE-2026-66729 facil.io 0.6.0 - 0.7.6 Integer Underflow DoS via Multipart MIME Body Parser

facil.io 0.6.0 through 0.7.6 contains an integer underflow vulnerability in the multipart MIME body parser that allows unauthenticated remote attackers to crash the server process by sending a crafted Content-Disposition header with an empty field name. Attackers can trigger a uint32t wraparound ...