401314 matches found
PT-2026-120531
Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload. Root Cause: The HTTP/2 DATA frame handler...
PT-2026-120734
Name of the Vulnerable Software and Affected Versions Nuxt versions 3.11.0 through 3.21.3 Nuxt versions 4.0.0 through 4.4.3 Description Nuxt compares route-rule keys with the raw request path, whereas route resolution decodes dynamic and catch-all parameters. This discrepancy allows a...
PT-2026-120212
Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allows unauthenticated attackers to inject data into run streams. Attackers can send POST requests to /realtime/v1/streams/:runId/:streamId with a predictable run friendlyId to injec...
PT-2026-134582
TuxCare rebuilt org.springframework.data:spring-data-mongodb to address 1 CVE. Fixed in 3.3.10-tuxcare.3...
ALSA-2026:86970 Moderate: cockpit-machines security update
Cockpit component for managing libvirt virtual machines. Security Fixes: cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments CVE-2026-92768 cockpit-machines: cockpit-machines: Sensitive Data Exposure of guest credentials via JSON argument in process list...
PT-2026-120576
Chamilo LMS from 2.0.0-alpha.4 before 2.0.0-RC.3 contains a missing authorization vulnerability in AiController::openAnswerGrade that allows any authenticated user to obtain AI grading of other students' exam attempts. Attackers can enumerate exeId and questionId values sent to the open answer...
AlmaLinux 9.2 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792599160)
The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792599160 advisory. - A flaw was found in libsoup. The soupuridecodedatauri function incorrectly treated base64 data-URI payloads as NUL-terminated...
Isolated component Data Compromise
The vulnerability in the Isolated web browser components of Google Chrome and Microsoft Edge is related to improper authorization. Exploitation of this vulnerability enables a remote attacker to compromise the integrity of protected information by using a specially crafted HTML page...
Google Chrome Microsoft Edge Data Compromise
The Parser component vulnerability in Google Chrome and Microsoft Edge is related to a lack of secure information handling mechanisms. Exploitation of this vulnerability enables a remote attacker to compromise the integrity of protected information by using a specially crafted HTML page...
camel-netty-http Apache Camel Bypass Security
The vulnerability of the camel-netty-http component of the Apache Camel framework is related to deficiencies in the mechanism for handling registry-dependent data. Exploiting this vulnerability could allow a malicious actor to bypass existing security measures remotely...
Google Chrome Microsoft Edge Data Compromise
The Permissions control element vulnerability in Google Chrome and Microsoft Edge is related to a flaw in the data source validation mechanism. Exploitation of this vulnerability enables a remote attacker to compromise the integrity of protected information by using a specially crafted HTML page...
Linux arch/arm64/include/asm/exception.h Data Compromise
The vulnerability of the arch/arm64/include/asm/exception.h component in the Linux operating system is related to insufficient resource control during its existence. Exploiting this vulnerability could allow an attacker to compromise the confidentiality and accessibility of protected information...
WebUIs Google Chrome Microsoft Edge Data Compromise
The WebUI user interface vulnerability in Google Chrome and Microsoft Edge is related to improper authorization. Exploitation of this vulnerability enables a remote attacker to compromise the integrity of protected information by using a specially crafted HTML page...
Google Chrome Microsoft Edge Data Compromise
The vulnerability in the Extensions component of Google Chrome and Microsoft Edge is related to a lack of proper data protection mechanisms. Exploitation of this vulnerability could allow a remote attacker to compromise the integrity of protected information...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-gunicorn (UTSA-2026-142339)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142339 advisory. Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling HRS vulnerabilities. By crafting requests with conflicting...
Linux Distros Unpatched Vulnerability : CVE-2026-91332
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in Oracle Java SE component: Networking. Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1,...
Linux Distros Unpatched Vulnerability : CVE-2026-91411
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JGSS. Supported versions tha...
Linux Distros Unpatched Vulnerability : CVE-2026-91452
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. Supported versio...
Linux Distros Unpatched Vulnerability : CVE-2026-91462
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JGSS. Supported versions tha...
PT-2026-120444
The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL...