9753 matches found
EUVD-2026-42239
An authorization bypass in MISP’s EventsController::importModule allowed authenticated users or read-only API keys with event view access to persist data to events they were not allowed to modify. When an import module returned results in the mispstandard format, the write path did not verify eve...
CVE-2026-59998
A flaw was found in OpenSSH. The sshd component has an undocumented security-relevant behavior where GSSAPIStrictAcceptorCheck has no value when the server is in a Windows Active Directory environment. This could lead to unintended information disclosure and impact data integrity. Mitigation To...
The vulnerability of the Picomatch library lies in the uncontrolled modification of object prototype attributes, which allows attackers to compromise data integrity.
The vulnerability of the Picomatch library is related to uncontrolled changes to the attributes of the object’s prototype. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of the data...
The vulnerabilities of the functions sctp_auth_set_key() and sctp_auth_set_active_key() in the net/sctp/auth.c module of the Linux operating system’s SCTP (Stream Control Transmission Protocol) kernel allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerabilities of the functions sctpauthsetkey and sctpauthsetactivekey in the net/sctp/auth.c module of the Linux operating system’s SCTP protocol implementation are related to the reutilization of previously freed memory. Exploiting these vulnerabilities can allow a remote attacker to...
The vulnerability of the console-based graphic editor ImageMagick arises from the possibility of an operation exceeding the buffer boundaries in memory, allowing attackers to compromise the integrity and accessibility of the protected information.
The vulnerability of the console-based graphic editor ImageMagick is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to compromise the integrity and accessibility of the protected information...
The vulnerability of the Lodash library lies in the uncontrolled modification of prototype attributes, which allows attackers to compromise the integrity and accessibility of the protected information.
The vulnerability of the Lodash library is related to uncontrolled changes to the attributes of the object’s prototype. Exploiting this vulnerability could allow an attacker, operating remotely, to compromise the integrity and accessibility of the protected information...
PT-2026-56450
An authorization bypass in MISP’s EventsController::importModule allowed authenticated users or read-only API keys with event view access to persist data to events they were not allowed to modify. When an import module returned results in the misp standard format, the write path did not verify...
The vulnerability of the _.unset and _.omit functions in the Lodash library, which allows an attacker to compromise data integrity
The vulnerability of the unset and omit functions in the Lodash library is related to uncontrolled changes to prototype attributes of objects. Exploiting this vulnerability could allow a malicious actor to compromise data integrity...
EUVD-2026-25038
cut: -s ignored in -z -d '' newline-delimiter mode...
nats-server: NATS Server: Protocol stream corruption and unintended operation injection via MQTT client subscription filters
A flaw was found in NATS Server. An authenticated MQTT client could exploit this by embedding protocol control characters within subscription filters. These characters would then be forwarded as NATS protocol data to route or leafnode connections, leading to the corruption of the protocol stream...
nats-server: NATS Server: Protocol stream corruption and unintended operation injection via MQTT client subscription filters
A flaw was found in NATS Server. An authenticated MQTT client could exploit this by embedding protocol control characters within subscription filters. These characters would then be forwarded as NATS protocol data to route or leafnode connections, leading to the corruption of the protocol stream...
nodejs: Node.js: Certification validation bypass in TLS host verification
A flaw was found in Node.js. An attacker can exploit a vulnerability in the Transport Layer Security TLS host verification process to bypass certification validation. This bypass could allow an attacker to intercept or alter communications, potentially leading to information disclosure or integri...
undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery.
A flaw was found in undici. An attacker-controlled upstream server can exploit a vulnerability in Undici's HTTP/1.1 client, specifically related to response queue poisoning on reused keep-alive sockets. This allows the attacker to inject an unsolicited HTTP/1.1 response onto an idle socket...
undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing
A flaw was found in undici. When using Socks5ProxyAgent, undici incorrectly reuses a single connection pool across different origins. This can lead to cross-origin request routing, where sensitive credentials and data intended for one destination are sent to another. Consequently, responses from...
Use Of A Broken Or Risky Cryptographic Algorithm
BC-JAVA bcprov is vulnerable to the Use of a Broken or Risky Cryptographic Algorithm. The vulnerability is due to flaws in the G3413CTRBlockCipher implementation, where the affected cryptographic algorithm can provide weakened cryptographic protection, allowing attackers to compromise the...
CVE-2026-54891
A flaw was found in Erlang's SSL Secure Sockets Layer component. A network-positioned attacker can exploit this vulnerability by injecting unauthenticated plaintext data into a client's TLS Transport Layer Security handshake. The client application may then process this injected data as if it wer...
libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse
A flaw was found in curl. The libcurl library, used for transferring data with URLs, could improperly reuse existing network connections. This occurred even when changes to mutual Transport Layer Security mTLS settings, particularly those for client certificates, should have prevented such reuse...
HdrHistogram: HdrHistogram: Data integrity impact due to incorrect comparison
A flaw was found in HdrHistogram. This vulnerability affects the DoubleHistogram.recordValue function, which is part of the Range Check component. A local attacker can exploit this flaw by performing a specific manipulation, leading to an incorrect comparison of values. This issue primarily impac...
ROS-20260702-73-0024
The vulnerability of the persistentrampostinit function in the fs/pstore/ramcore.c module, which supports the persistent storage of the Linux kernel, is related to incorrect initialization of the resource. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...
nodejs: Node.js: Certification validation bypass in TLS host verification
A flaw was found in Node.js. An attacker can exploit a vulnerability in the Transport Layer Security TLS host verification process to bypass certification validation. This bypass could allow an attacker to intercept or alter communications, potentially leading to information disclosure or integri...