.NET: .NET: Network Spoofing Vulnerability

A flaw was found in .NET. An authorized attacker can exploit this vulnerability by leveraging improper encoding or escaping of output. This allows the attacker to perform spoofing over a network, potentially deceiving users or systems into believing they are interacting with a trusted entity...

Linux Distros Unpatched Vulnerability : CVE-2026-58081

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly check the size of the caller-supplied output buffer before writing converted...

PT-2026-81028

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.137.Final Netty versions prior to 4.2.17.Final Description Netty is an asynchronous, event-driven network application framework. The MqttEncoder does not validate client identifiers, will topics, usernames, and...

The vulnerability of the HEIF and AVIF file encoding/decoding library lies in its ability to trigger service interruptions when reading data beyond the permissible buffer size.

The vulnerability of the HEIF and AVIF file encoding/decoding library lies in reading data from buffers beyond their acceptable limits. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

PT-2026-80191

Name of the Vulnerable Software and Affected Versions fast-uri versions 2.4.1 through 2.4.4 fast-uri versions 3.1.2 through 3.1.5 fast-uri versions 4.0.0 through 4.1.2 Description This URI parser for Node.js decodes percent escapes in a hostname during parsing and subsequently decodes the parsed...

CVE-2026-76172: Improper Handling of URL Encoding (Hex Encoding)

fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries...

EUVD-2026-64602

In strongSwan before 6.0.7, identity parsing/cloning is mishandled. Parsed EAP-Identities that result in an empty but non-NULL encoding are not correctly cloned and trigger a double-free once the duplicates are destroyed...

CVE-2026-18027 WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 4.9.8 - Authenticated (Subscriber+) Arbitrary File Read via 'customer_note' Parameter

The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.9.8 via the getimagesrcinbase64 function. This makes it possible for authenticated attackers, with...

AZL-97377 CVE-2026-47895 affecting package strongswan for versions less than 5.9.14-10

In strongSwan before 6.0.7, identity parsing/cloning is mishandled. Parsed EAP-Identities that result in an empty but non-NULL encoding are not correctly cloned and trigger a double-free once the duplicates are destroyed...

CVE-2026-62381

luci-lib-px5g LuCI contains a heap-based buffer overflow in the native ASN.1 encoding routine asn1addobj x509write.c when signing a certificate with a 2040-bit RSA key. For a 255-byte signature, the BIT STRING allocation is computed from the DER length encoding of 255 bytes, but the payload writt...

CVE-2026-62381 luci-lib-px5g 2040-bit Certificate Signing Heap Buffer Overflow

luci-lib-px5g LuCI contains a heap-based buffer overflow in the native ASN.1 encoding routine asn1addobj x509write.c when signing a certificate with a 2040-bit RSA key. For a 255-byte signature, the BIT STRING allocation is computed from the DER length encoding of 255 bytes, but the payload writt...

CVE-2026-62381 luci-lib-px5g 2040-bit Certificate Signing Heap Buffer Overflow

luci-lib-px5g LuCI contains a heap-based buffer overflow in the native ASN.1 encoding routine asn1addobj x509write.c when signing a certificate with a 2040-bit RSA key. For a 255-byte signature, the BIT STRING allocation is computed from the DER length encoding of 255 bytes, but the payload writt...

EUVD-2026-64273

luci-lib-px5g LuCI contains a heap-based buffer overflow in the native ASN.1 encoding routine asn1addobj x509write.c when signing a certificate with a 2040-bit RSA key. For a 255-byte signature, the BIT STRING allocation is computed from the DER length encoding of 255 bytes, but the payload writt...

CVE-2026-62381

luci-lib-px5g (LuCI) in OpenWrt contains a heap-based buffer overflow in the ASN.1 encoding routine asn1_add_obj (x509write.c) triggered when signing a certificate with a 2040-bit RSA key . The BIT STRING allocation is sized for a 255-byte signature's DER length encoding, but prepending the unuse...

Improper Resource Shutdown

Apache HttpComponents Client is vulnerable to Improper Resource Shutdown. The vulnerability is due to the classic I/O model failing to release connections back to the connection manager when processing an invalid or unsupported Content-Encoding header value, potentially exhausting available...

SUSE CVE-2026-63382

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttpfindheader can select only the first...

CVE-2026-47895

In strongSwan before 6.0.7, identity parsing/cloning is mishandled. Parsed EAP-Identities that result in an empty but non-NULL encoding are not correctly cloned and trigger a double-free once the duplicates are destroyed...

PT-2026-79548

Name of the Vulnerable Software and Affected Versions luci-lib-px5g versions 18.06 through 25.12 Description A heap-based buffer overflow exists in the native ASN.1 encoding routine asn1 add obj within x509write.c when signing a certificate using a 2040-bit RSA key. The issue occurs because the B...

CVE-2026-47895

strongSwan before 6.0.7 is affected by a double-free vulnerability in its identity parsing/cloning logic. When parsed EAP-Identities produce an empty but non-NULL encoding, the resulting duplicates are not correctly cloned, triggering a double-free upon destruction. The Fedora advisory characteri...

Fedora 44 : perl-URI (2026-32b0d26c4c)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-32b0d26c4c advisory. 5.36 - Apply Unicode NFC normalization in URI::idna nameprep so IDNA host encoding matches other clients instead of emitting a non-standard, non-round-trippi...