14715 matches found
CVE-2026-90622 GNU libredwg Layer Encoding dwg.spec DWG_TABLE null pointer dereference
A security flaw has been discovered in GNU libredwg 0.13.4. This impacts the function DWGTABLE of the file src/dwg.spec of the component Layer Encoding. Performing a manipulation results in null pointer dereference. The attack needs to be approached locally. The exploit has been released to the...
CVE-2026-90622 GNU libredwg Layer Encoding dwg.spec DWG_TABLE null pointer dereference
A security flaw has been discovered in GNU libredwg 0.13.4. This impacts the function DWGTABLE of the file src/dwg.spec of the component Layer Encoding. Performing a manipulation results in null pointer dereference. The attack needs to be approached locally. The exploit has been released to the...
CVE-2026-15634: Inconsistent Interpretation of HTTP Requests
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request header, an attacker could...
CVE-2026-90622: NULL Pointer Dereference
A security flaw has been discovered in GNU libredwg 0.13.4. This impacts the function DWGTABLE of the file src/dwg.spec of the component Layer Encoding. Performing a manipulation results in null pointer dereference. The attack needs to be approached locally. The exploit has been released to the...
Important: git-lfs security update
Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal...
RHEL 10 : rhc-worker-playbook (RHSA-2026:67464)
The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:67464 advisory. A worker for yggdrasil that receives Ansible playbooks and executes them against the local host. Security Fixes: encoding/asn1: golang: Go...
CVE-2026-15396: Inconsistent Interpretation of HTTP Requests
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request header, an attacker could...
PT-2026-91440
Name of the Vulnerable Software and Affected Versions Squid proxy affected versions not specified Description An issue involving request smuggling in HTTP Transfer-Encoding allows a trusted client to poison the web cache. This enables the storage of arbitrary malicious content at any URL, which c...
PT-2026-91040
Name of the Vulnerable Software and Affected Versions GNU libredwg version 0.13.4 Description A security flaw in the Layer Encoding component exists within the DWG TABLE function of the src/dwg.spec file. A local manipulation can lead to a null pointer dereference, which occurs when raw zeroing...
AlmaLinux 8 : git-lfs (ALSA-2026:67161)
The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:67161 advisory. encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial of...
PT-2026-91448
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request header, an attacker could...
CVE-2026-73195: Improper Encoding or Escaping of Output
Improper Encoding or Escaping of Output vulnerability in Apache Syncope. Authenticated users can store a spreadsheet formula payload in one of their own plain attributes. When such users are included in a CSV export and the generated CSV file is opened by a spreadsheet application, the formula ma...
PT-2026-91450
Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server 9.0 IBM WebSphere Application Server 8.5 IBM WebSphere Application Server - Liberty affected versions not specified Description Improper parsing of the HTTP transfer-encoding request header allows for HTTP...
Out-of-bounds Read
Overview Affected versions of this package are vulnerable to Out-of-bounds Read due to improper handling of padding in the extradata allocation process within WMA encoding. An attacker can cause a denial of service by triggering an out-of-bounds read through specially crafted input data...
waf-checker v1.2.0
WAF Checker This project helps you check how well your Web Application Firewall WAF protects your product against common web attacks. It can be run as a Cloudflare Worker with a built-in interactive Web UI or as a standalone Node.js CLI tool. Features Core Testing Enter a target URL, pick HTTP...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libvpx (UTSA-2023-003033)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-003033 advisory. Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap...
CVE-2026-52296
FFmpeg versions before 9.0 are affected by an out-of-bounds read caused by missing required padding in the WMA extradata allocation paths within libavcodec/wmaenc.c . The vulnerability is rated LOW (CVSS 3.1 score 2.9) with a local attack vector and high complexity, resulting in a limited availab...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libvpx (UTSA-2023-003032)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-003032 advisory. VP9 in libvpx before 1.13.1 mishandles widths, leading to a crash related to encoding. Tenable has extracted the preceding description block directly from the Unity...
