Lucene search
+L

1530 matches found

ATTACKERKB
ATTACKERKB
added 2026/04/08 1:32 p.m.6 views

CVE-2026-5795

In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals. A subsequent reques...

7.4CVSS6AI score0.00529EPSS
SaveExploits0References3Affected Software1
Debian CVE
Debian CVE
added 2026/04/08 1:32 p.m.14 views

CVE-2026-5795

In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals. A subsequent reques...

7.4CVSS5.4AI score0.00529EPSS
SaveExploits0
Positive Technologies
Positive Technologies
added 2026/04/08 12:00 a.m.14 views

PT-2026-31308

Name of the Vulnerable Software and Affected Versions Eclipse Jetty affected versions not specified Description Eclipse Jetty's JASPIAuthenticator class sets two ThreadLocal variables during authentication checks. Under certain conditions, the code returns early without clearing these ThreadLocal...

7.4CVSS5.8AI score0.00529EPSS
SaveExploits0References30
CNNVD
CNNVD
added 2026/04/08 12:00 a.m.12 views

CI4MS 授权问题漏洞

CI4MS is an open-source blog page management tool developed by Ci4MS. Versions of CI4MS prior to 0.31.4.0 contained a vulnerability related to authorization issues, which allowed attackers to access sensitive system information...

7.2CVSS5.8AI score0.00471EPSS
SaveExploits1References2
CNNVD
CNNVD
added 2026/04/07 12:00 a.m.12 views

Semtech LR11xx LoRa 安全漏洞

Semtech LR11xx LoRa is a series of low-power wireless communication chips developed by the American company Semtech. There are security vulnerabilities in Semtech LR11xx LoRa. These vulnerabilities stem from improper access control in earlier firmware versions, which may allow attackers with...

5.4CVSS6AI score0.00243EPSS
SaveExploits1References1
Github Security Blog
Github Security Blog
added 2026/03/31 11:49 p.m.11 views

parse-server has GraphQL complexity validator exponential fragment traversal DoS

Impact The GraphQL query complexity validator can be exploited to cause a denial-of-service by sending a crafted query with binary fan-out fragment spreads. A single unauthenticated request can block the Node.js event loop for seconds, denying service to all concurrent users. This only affects...

8.2CVSS5.9AI score0.00463EPSS
SaveExploits0References7Affected Software1
SUSE CVE
SUSE CVE
added 2026/03/31 11:28 p.m.7 views

SUSE CVE-2026-24029

When the earlyacldrop earlyACLDrop in Lua option is disabled default is enabled on a DNS over HTTPs frontend using the nghttp2 provider, the ACL check is skipped, allowing all clients to send DoH queries regardless of the configured ACL...

4.8CVSS5.9AI score0.00148EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/03/31 12:31 p.m.13 views

EUVD-2026-17403

When the earlyacldrop earlyACLDrop in Lua option is disabled default is enabled on a DNS over HTTPs frontend using the nghttp2 provider, the ACL check is skipped, allowing all clients to send DoH queries regardless of the configured ACL...

6.5CVSS5.9AI score0.00148EPSS
SaveExploits0References2
NVD
NVD
added 2026/03/31 12:16 p.m.14 views

CVE-2026-24029

When the earlyacldrop earlyACLDrop in Lua option is disabled default is enabled on a DNS over HTTPs frontend using the nghttp2 provider, the ACL check is skipped, allowing all clients to send DoH queries regardless of the configured ACL...

6.5CVSS0.00148EPSS
SaveExploits0References1
OSV
OSV
added 2026/03/31 12:16 p.m.10 views

UBUNTU-CVE-2026-24029

When the earlyacldrop earlyACLDrop in Lua option is disabled default is enabled on a DNS over HTTPs frontend using the nghttp2 provider, the ACL check is skipped, allowing all clients to send DoH queries regardless of the configured ACL...

6.5CVSS5.8AI score0.00148EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2026/03/31 11:59 a.m.5 views

CVE-2026-24029

When the earlyacldrop earlyACLDrop in Lua option is disabled default is enabled on a DNS over HTTPs frontend using the nghttp2 provider, the ACL check is skipped, allowing all clients to send DoH queries regardless of the configured ACL...

6.5CVSS5.9AI score0.00148EPSS
SaveExploits0References2Affected Software1
Cvelist
Cvelist
added 2026/03/31 11:59 a.m.35 views

CVE-2026-24029 DNS over HTTPS ACL bypass

When the earlyacldrop earlyACLDrop in Lua option is disabled default is enabled on a DNS over HTTPs frontend using the nghttp2 provider, the ACL check is skipped, allowing all clients to send DoH queries regardless of the configured ACL...

6.5CVSS0.00148EPSS
SaveExploits0References1
Debian CVE
Debian CVE
added 2026/03/31 11:59 a.m.13 views

CVE-2026-24029

When the earlyacldrop earlyACLDrop in Lua option is disabled default is enabled on a DNS over HTTPs frontend using the nghttp2 provider, the ACL check is skipped, allowing all clients to send DoH queries regardless of the configured ACL...

6.5CVSS5.2AI score0.00148EPSS
SaveExploits0
CVE
CVE
added 2026/03/31 11:59 a.m.35 views

CVE-2026-24029

CVE-2026-24029 affects a DNS-over-HTTPS frontend using the nghttp2 provider. When the early_acl_drop (earlyACLDrop in Lua) option is disabled, the ACL check is skipped, permitting all clients to issue DoH queries regardless of the configured ACL. The default setting enables early_acl_drop, so the...

6.5CVSS5.9AI score0.00148EPSS
SaveExploits0References1Affected Software1
Vulnrichment
Vulnrichment
added 2026/03/31 11:59 a.m.3 views

CVE-2026-24029 DNS over HTTPS ACL bypass

When the earlyacldrop earlyACLDrop in Lua option is disabled default is enabled on a DNS over HTTPs frontend using the nghttp2 provider, the ACL check is skipped, allowing all clients to send DoH queries regardless of the configured ACL...

6.5CVSS5.9AI score0.00148EPSS
SaveExploits0References1
AlpineLinux
AlpineLinux
added 2026/03/31 11:59 a.m.13 views

CVE-2026-24029

When the earlyacldrop earlyACLDrop in Lua option is disabled default is enabled on a DNS over HTTPs frontend using the nghttp2 provider, the ACL check is skipped, allowing all clients to send DoH queries regardless of the configured ACL...

6.5CVSS5.8AI score0.00148EPSS
SaveExploits0
OSV
OSV
added 2026/03/31 11:59 a.m.7 views

CVE-2026-24029 DNS over HTTPS ACL bypass

When the earlyacldrop earlyACLDrop in Lua option is disabled default is enabled on a DNS over HTTPs frontend using the nghttp2 provider, the ACL check is skipped, allowing all clients to send DoH queries regardless of the configured ACL...

6.5CVSS6AI score
SaveExploits0References5
CNNVD
CNNVD
added 2026/03/31 12:00 a.m.16 views

PowerDNS DNSdist 安全漏洞

PowerDNS DNSdist is a proxy software provided by PowerDNS that offers capabilities for DNS traffic load balancing and security protection. PowerDNS DNSdist has a security vulnerability that arises from skipping ACL checks when the earlyacl Drop option is disabled. This vulnerability may cause all...

6.5CVSS5.8AI score0.00148EPSS
SaveExploits0References2
UbuntuCve
UbuntuCve
added 2026/03/25 11:16 a.m.15 views

CVE-2026-23339

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: free skb on ncitransceive early error paths ncitransceive takes ownership of the skb passed by the caller, but the -EPROTO, -EINVAL, and -EBUSY error paths return without freeing it. Due to issues clearing NCIDATAEXCHAN...

5.5CVSS5.3AI score0.00123EPSS
SaveExploits0References32
Debian CVE
Debian CVE
added 2026/03/25 10:27 a.m.21 views

CVE-2026-23339

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: free skb on ncitransceive early error paths ncitransceive takes ownership of the skb passed by the caller, but the -EPROTO, -EINVAL, and -EBUSY error paths return without freeing it. Due to issues clearing NCIDATAEXCHAN...

5.5CVSS5.2AI score0.00123EPSS
SaveExploits0
Rows per page
Query Builder