15674 matches found
PT-2026-65508
schreibfaul1 ESP32-audioI2S 3.4.5 has a heap-based buffer overflow vulnerability in the URL path concatenation and encoding module. The application splices untrusted extension path and attacker-controlled query string into a path buffer, then invokes urlencode without validating the final string...
CVE-2026-51267
...
CVE-2026-51269
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
CVE-2026-51267
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
EUVD-2026-49865
schreibfaul1 ESP32-audioI2S 3.4.5 has a heap-based buffer overflow vulnerability in the URL path concatenation and encoding module. The application splices untrusted extension path and attacker-controlled query string into a path buffer, then invokes urlencode without validating the final string...
CVE-2026-51270
...
CentOS 9 : opencryptoki-3.27.0-1.el9
The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the opencryptoki-3.27.0-1.el9 build changelog. - openCryptoki is a PKCS11 library and provides tooling for Linux and AIX. In versions 3.26.0 and below, the BER/DER decoding functions in the...
FreeBSD : Erlang/OTP -- heap corruption decoding invalidly encoded large tuples (445df078-89e1-11f1-b35c-4c526214c986)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 445df078-89e1-11f1-b35c-4c526214c986 advisory. The Erlang/OTP team reports: Fixed heap corruption when an invalidly encoded tuple with an arity of 2^3...
PT-2026-65522
tiny-http through 0.12.0 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize request framing by sending a Transfer-Encoding header with any value, including non-chunked codings, which causes the library to unconditionally apply chunk-decoding and discard...
CVE-2026-66752: Inconsistent Interpretation of HTTP Requests
tiny-http through 0.12.0 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize request framing by sending a Transfer-Encoding header with any value, including non-chunked codings, which causes the library to unconditionally apply chunk-decoding and discard...
PT-2026-65525
Name of the Vulnerable Software and Affected Versions Rouille versions 0.3.3 through 3.6.2 Description An HTTP request smuggling issue exists due to improper header forwarding within the proxy implementation located in src/proxy.rs. The proxy forwards the client's Transfer-Encoding header to...
CVE-2026-51267
CVE-2026-51267 entry is rejected/not used; not a security issue.
Benchmarking Optical Receivers for Quantum Communication and Randomness Certification
The choice of optical receiver determines which properties of the transmitted states remain visible in the observed data and therefore affects the performance of different quantum protocols. We compare continuous-variable, photon-counting and hybrid receivers within the same prepare-and-measure...
librenswan: IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload
A flaw was found in Libreswan's implementation of IKEv2 authentication when processing signatures utilizing the RSASSA-PKCS1-v15 scheme. The RSAauthenticatehashsignaturepkcs115rsa function does not correctly validate the DER encoding of the ASN.1 digest. A remote, unauthenticated attacker could...
CVE-2026-66731
facil.io 0.7.5 through 0.7.6 contains a denial-of-service vulnerability in the HTTP/1.1 chunked transfer encoding parser that allows unauthenticated remote attackers to crash the server by sending a negative chunk size value. Attackers can send a single POST request with a Transfer-Encoding:...
SUSE CVE-2026-50721
Libreswan, via the function RSAauthenticatehashsignaturerawrsa, did not correctly verify the length of the authentication hash when the SIG payload of an IKEv1 packet was encoded using PKCS 1 RSA Encryption as per RFC 2313. A remote attacker can use a variation on the Bleichenbacher attack to for...
SUSE CVE-2026-50722
Libreswan, via the function RSAauthenticatehashsignaturepkcs115rsa, did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v15 RFC 8017. A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload...
CVE-2026-66731
facil.io 0.7.5–0.7.6 contains a remote DoS in the HTTP/1.1 chunked transfer encoding parser. The vulnerability arises when a negative chunk size value is sent via a Transfer-Encoding: chunked header, causing http1_parser.h to negate the size, compute a large positive value, corrupt internal state...
CVE-2026-66731
facil.io 0.7.5 through 0.7.6 contains a denial-of-service vulnerability in the HTTP/1.1 chunked transfer encoding parser that allows unauthenticated remote attackers to crash the server by sending a negative chunk size value. Attackers can send a single POST request with a Transfer-Encoding:...