tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve

A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding hex encoding. A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actio...

Malicious code in akamaijs-sensor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14a4955c82b04226b267bc55691b0b9c08770710a7038b58e75bfdd009d046fe The package presents itself as an Akamai sensor generator but ships two coupled malicious mechanisms. index.js contains a / / comment filled with...

Malicious code in relativity-foundation-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c61f9e4ea2d66ea8dd4b9018fa109fe65d00cb0de98b3f8551a95ca3859af5d package.json declares a preinstall script that runs a Node one-liner collecting os.hostname, process.env.USER/USERNAME, cwd, npmconfigregistry, CI,...

EUVD-2026-53360

OpenBK7231T's httpfnotaexec src/httpserver/httpfns.c reflects the host query parameter directly into an HTML response via hprintf255request, "OTA requested for %s!", tmpA with no HTML encoding, allowing a crafted URL such as /otaexec?host=alert1 to execute JavaScript in an authenticated admin's...

CVE-2026-71275 OpenBK7231T - Reflected XSS via OTA host Parameter

OpenBK7231T's httpfnotaexec src/httpserver/httpfns.c reflects the host query parameter directly into an HTML response via hprintf255request, "OTA requested for %s!", tmpA with no HTML encoding, allowing a crafted URL such as /otaexec?host=alert1 to execute JavaScript in an authenticated admin's...

CVE-2026-71274 OpenBK7231T Stored XSS via Unsanitized MQTT-Set Channel Labels

OpenBK7231T's CHANNELSetLabel src/cmnds/cmdchannels.c stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitization. CHANNELGetLabel returns these labels unsanitized, and they are rendered via hprintf255 at 15+ locations in src/httpserver/httpfns.c wit...

Security update for libXfont2

This update for libXfont2 fixes the following issues: CVE-2026-44950: fsreadglyphs heap buffer overflow via cumulative glyph data overflow bsc1272661. CVE-2026-59679: fsreadglyphs heap OOB read/write via encoding array index mismatch bsc1272660. Patch Instructions: To install this SUSE update use...

SUSE-SU-2026:3499-1 Security update for libXfont2

This update for libXfont2 fixes the following issues: - CVE-2026-44950: fsreadglyphs heap buffer overflow via cumulative glyph data overflow bsc1272661. - CVE-2026-59679: fsreadglyphs heap OOB read/write via encoding array index mismatch bsc1272660...

CVE-2026-71209 audiobookshelf - %2F Encoding Discrepancy Bypasses Cover/Image Auth Exemption Regex, Enabling Unauthenticated Path Traversal

audiobookshelf's authentication-exemption check server/routers/Auth.js matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /items/:id/cover or /authors/:id/image shape, where req.path retains %2F sequences URL-encoded. CacheManager.handleCoverCache then joi...

CVE-2026-71209

Audiobookshelf CVE-2026-71209 describes an authentication-exemption bypass in server/routers/Auth.js. The regex checks unauthenticated GET routes against req.path, but because req.path can contain URL-encoded %2F sequences, an encoded directory traversal like ..%2f..%2f..%2ftmp%2fpwned escapes th...

libXfont2 -- multiple vulnerabilities

Zhixi "Jace" Sun, independent security researcher reports: CVE-2026-44950: Font Server Client Cumulative Glyph Data Heap Buffer Overflow CVE-2026-59679: Font Server Client encoding Out-Of-Bounds Read/Write...

UBUNTU-CVE-2026-59679

Font Server Client encoding Out-Of-Bounds Read/Write...

CVE-2026-67873

CVE-2026-67873 affects lib60870-C 2.4.0, specifically the server-side FileSegment ASDU encoding path. The root cause is a heap-based buffer overflow caused by FileSegment_encode() validating only the standalone segment length via FileSegment_GetMaxDataSize(), without verifying the residual capaci...

CVE-2026-67873

A heap-based buffer overflow exists in lib60870-C 2.4.0 in the server-side FileSegment ASDU encoding path. The issue occurs because FileSegmentencode validates only the standalone segment length via FileSegmentGetMaxDataSize and does not verify the residual capacity of the current ASDU frame befo...

MiracleLinux 8 : java-17-openjdk-17.0.20.0.8-1.1.el8 (AXSA:2026-1403:11)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1403:11 advisory. JDK: Enhance TLS certificate handling CVE-2026-46968 JDK: Improve DTLS handshaking CVE-2026-46917 JDK: Enhance JPEG handling CVE-2026-47010 JDK:...

CVE-2026-45100

A flaw was found in OpenSIPS, a Session Initiation Protocol SIP server. A remote attacker can exploit a buffer overflow vulnerability in the s.b64encode string transformation. By sending a large SIP message header, the attacker can cause the base64 encoding process to write data beyond its intend...

CVE-2026-45100

OpenSIPS is a Session Initiation Protocol SIP server implementation. Versions 3.4.0-beta through 3.6.5 and 4.0.0-beta contain a buffer overflow in the s.b64encode string transformation. The size check for s.b64encode only verifies that the input fits within the 64 KB transformation buffer, but...

CVE-2026-45100 OpenSIPS: Buffer Overflow in Base64 Encode Transformation

OpenSIPS is a Session Initiation Protocol SIP server implementation. Versions 3.4.0-beta through 3.6.5 and 4.0.0-beta contain a buffer overflow in the s.b64encode string transformation. The size check for s.b64encode only verifies that the input fits within the 64 KB transformation buffer, but...

CVE-2026-45100

OpenSIPS contains a buffer overflow in the s.b64encode transformation affecting versions 3.4.0-beta through 3.6.5 and 4.0.0-beta. The 64 KB transformation buffer is overflowed because base64 encoding expands input by ~33%, so inputs around 49,153–65,535 bytes can overflow and overwrite adjacent m...

pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values

A remote attacker can exploit this by providing specially crafted BER/CER/DER-encoded ASN.1 data with a large exponent in the REAL value. When the application subsequently prints, logs, compares, or performs arithmetic on the decoded value, this can cause excessive CPU and memory consumption,...