344347 matches found
Security Bulletin: IBM Maximo Application Suite - Location Service for Esri Component is vulnerable to CVE-2026-18513, CVE-2026-18537, CVE-2026-18529, CVE-2026-18533, CVE-2026-18517 and CVE-2026-88029
Summary IBM Maximo Application Suite - Location Service for Esri Component is vulnerable to CVE-2026-18513, CVE-2026-18537, CVE-2026-18529, CVE-2026-18533, CVE-2026-18517 and CVE-2026-88029 because of CR author can redirect arcgis-admin RoleBinding to own ServiceAccount, CR author can override...
Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)
Summary A timing side-channel vulnerability exists in the PKCE RFC 7636 implementation of the Authorization Code Grant flow. The codechallengemethodplain function uses Python's standard == operator for string comparison instead of a constant-time comparison function, potentially allowing...
CVE-2022-0482_exploit
CVE-2022-0482 脆弱性の悪用 はじめに このドキュメントでは、Easy!Appointments スケジューリングソフトウェアで特定された重大なセキュリティ脆弱性である CVE-2022-0482 の詳細な分析について概説します。CWE-863 に分類される不適切な認可に関連するこの欠陥により、適切な認証なしに個人を特定できる情報への不正アクセスが可能になり、データの機密性と整合性に重大なリスクをもたらします。 著者 Mija Pilkaite 脆弱性の概要 CVE-2022-0482 は、1.4.3 より前のバージョンの Easy!Appointments...
CVE-2026-46394-haxcms-git-command-injection
CVE-2026-46394 - HAXcms Git.php 操作系统命令注入 CWE-78 仅用于授权安全测试和研究的概念验证。 此处描述的漏洞已在 HAXcms 的最新版本中修复 。 发布此 PoC 是为了让防御者和研究人员能够在他们拥有或明确获准测试的未打补丁实例上验证该问题。 | ---|--- CVE| CVE-2026-46394 组件| HAXcms PHP 后端 - system/backend/php/lib/Git.php 漏洞| 操作系统命令注入 CWE-78 严重性| 高危 - CVSS 3.1 7.2 独立 / 8.1 结合路径遍历 状态|...
AZL-105468 CVE-2026-84784 affecting package cloud-hypervisor 52.0.152-1
Issue summary: A malicious remote peer may flood the local QUIC stack with NEWCONNECTIONID frames by avoiding a limit check on how many connection IDs the remote QUIC stack can use. Impact summary: The local QUIC stack sends a RETIRECONNID frame for every NEWCONNECTIONID frame it receives. The...
ALPINE-CVE-2026-84784
Issue summary: A malicious remote peer may flood the local QUIC stack with NEWCONNECTIONID frames by avoiding a limit check on how many connection IDs the remote QUIC stack can use. Impact summary: The local QUIC stack sends a RETIRECONNID frame for every NEWCONNECTIONID frame it receives. The...
AZL-105849 CVE-2026-75806 affecting package rust 1.75.0-31
Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthenticated datagram whose encrypted fragment is shorter than the mandatory explicit IV and authentication tag overhead. Impact summary: An attacker who can send a datagram that is rout...
AZL-105570 CVE-2026-77696 affecting package openssl 3.3.7-6
Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidd...
DEBIAN-CVE-2026-75806
Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthenticated datagram whose encrypted fragment is shorter than the mandatory explicit IV and authentication tag overhead. Impact summary: An attacker who can send a datagram that is rout...
AZL-105897 CVE-2026-75806 affecting package rust 1.96.1-2
Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthenticated datagram whose encrypted fragment is shorter than the mandatory explicit IV and authentication tag overhead. Impact summary: An attacker who can send a datagram that is rout...
AZL-105594 CVE-2026-75804 affecting package openssl 3.3.7-6
Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...
ALPINE-CVE-2026-75804
Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...
AZL-105855 CVE-2026-75804 affecting package rust 1.75.0-31
Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...
AZL-105458 CVE-2026-75804 affecting package cloud-hypervisor 52.0.152-1
Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...
AZL-105636 CVE-2026-75804 affecting package openvmm 0.1.0-1
Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...
AZL-105894 CVE-2026-75804 affecting package rust 1.96.1-2
Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...
CVE-2026-75804
Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...
AZL-105495 CVE-2026-54873 affecting package kata-containers 4.1.0.kata0-1
Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Impact summary: Remote peer can exploit this vulnerability by sending maliciously crafted packets, making the local QUIC stack to keep the memory for packet buffers allocated. The time for...
AZL-105576 CVE-2026-54873 affecting package openssl 3.3.7-6
Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Impact summary: Remote peer can exploit this vulnerability by sending maliciously crafted packets, making the local QUIC stack to keep the memory for packet buffers allocated. The time for...
CVE-2026-54873
Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Impact summary: Remote peer can exploit this vulnerability by sending maliciously crafted packets, making the local QUIC stack to keep the memory for packet buffers allocated. The time for...