CVE-2026-14180

A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially...

CVE-2026-14180

A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially...

CVE-2026-72748

AVideo contains an unauthenticated arbitrary file write vulnerability in the aVideoEncoderChunk.json.php endpoint that allows remote attackers to write up to 4 GB of arbitrary content to the server filesystem via HTTP PUT requests without authentication. Attackers can exhaust disk space causing...

pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values

A remote attacker can exploit this by providing specially crafted BER/CER/DER-encoded ASN.1 data with a large exponent in the REAL value. When the application subsequently prints, logs, compares, or performs arithmetic on the decoded value, this can cause excessive CPU and memory consumption,...

PT-2026-70870

Name of the Vulnerable Software and Affected Versions insights-client affected versions not specified Description A flaw exists where a compromised managed cluster, known as a spoke, can inject unencoded data into the Insights API URL path. This happens because the ClusterID variable, which is...

PT-2026-70346

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description An Improper Encoding or Escaping of Output issue allows a low-privileged attacker to bypass security features. This can lead to limited unauthorized write acces...

PT-2026-70241

Name of the Vulnerable Software and Affected Versions Undertow HTTP server affected versions not specified WildFly affected versions not specified JBoss EAP affected versions not specified Description A flaw exists in the ChunkReader component of the Undertow HTTP server, which is utilized by...

Linux Distros Unpatched Vulnerability : CVE-2026-14180

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue...

Apache Tomcat 9.0.40 < 9.0.117 Improper Encoding or Escaping of Output Vulnerability (CVE-2026-34483)

The version of Tomcat installed on the remote host is 9.0.40 prior to 9.0.117. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat9.0.117security-9 advisory. - Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache...

CVE-2026-56619

HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting Reflected XSS due to insufficient validation and output encoding of user-controlled input...

CVE-2026-56619 HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting (Reflected XSS)

HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting Reflected XSS due to insufficient validation and output encoding of user-controlled input...

CVE-2026-56619

CVE-2026-56619 affects HCL BigFix Mobile. The issue is a Reflected Cross-Site Scripting (XSS) vulnerability caused by insufficient validation and output encoding of user-controlled input. The CVSS v3.1 base score is 5.4 (Medium) with Network attack, Low attack complexity, Privileges Required: Low...

EUVD-2026-55668

HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting Reflected XSS due to insufficient validation and output encoding of user-controlled input...

CVE-2026-56619 HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting (Reflected XSS)

HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting Reflected XSS due to insufficient validation and output encoding of user-controlled input...

CVE-2026-56619

HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting Reflected XSS due to insufficient validation and output encoding of user-controlled input...

CVE-2026-68316

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Fix element size accounting for cmd stream validation There are 2 issues with the element size handling in the command stream validation which result in too small of a size calculated when the element size is...

Malicious code in cryptostock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ab293d041a75fa4fcfb65c996176a885720e7b60cf3dde4b19154c073c29454 index.js is an obfuscated payload that, on require, starts a C2 client against https://badai.run.place: it registers a UID, long-polls...

CVE-2026-66486 Improper Output Encoding in GNU cpio

GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with...

CVE-2026-66486 Improper Output Encoding in GNU cpio

GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with...

CVE-2026-66486

GNU cpio is vulnerable to improper output encoding in archive member listings. When listing members with cpio -it, member names are printed directly to output without quoting or escaping, allowing crafted member names containing newline characters or ANSI escape sequences to produce forged listin...