10702 matches found
MINI-RP7F-HXPF-25GR
Bulletin has no description...
CVE-2026-60847: Improper Privilege Management
Vulnerability in the Oracle Order Entry product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Order Entry executes t...
PT-2026-62823
Vulnerability in the Oracle Order Entry product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Order Entry executes t...
CVE-2026-55831
Netty CVE-2026-55831 affects the SPDY SETTINGS decoder. Prior to 4.1.136.Final and 4.2.16.Final, the decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in DefaultSpdySettingsFrame. A remote SPDY/3.1 peer could send a s...
CVE-2026-55831
Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in...
GHSA-23HP-3JRH-7FPW node-tar: Decompression/parse DoS via unlimited input
Summary A Decompression/parse DoS via unlimited input vulnerability in node-tar allows an attacker to exhaust server resources disk space and CPU. Because the library does not enforce hard upper bounds on total decompressed data or entry counts, a small, maliciously crafted "Gzip Bomb" can be use...
GHSA-8X88-C5MF-7J5W node-tar: Negative tar entry size causes infinite loop in archive replace
Summary A checksum-valid tar archive with a negative base-256 encoded entry size can make tar.replace loop forever while scanning the existing archive. Applications that update attacker-controlled tar archives can have a worker process pinned indefinitely, causing denial of service. Details The...
Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`
Description PIL/GdImageFile.py GdImageFile.open reads image dimensions from the GD 2.x header and stores them in self.size without calling Image.decompressionbombcheck. Because GdImageFile is not registered with Image.registeropen, it never passes through the standard Image.open code path that...
CVE-2025-8173
creationtimestamp| type| source ---|---|--- 2026-07-20 19:00:06+00:00| seen| https://t.me/autodafemanuals/268 2026-07-21 00:00:24+00:00| seen| https://t.me/autodafemanuals/268 2026-07-22 00:00:29+00:00| published-proof-of-concept| https://t.me/autodafemanuals/268...
MINI-J3HC-CJC3-XM77
Bulletin has no description...
python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite
A flaw was found in pip, the package installer for Python. A remote attacker can exploit this vulnerability by tricking a victim into installing a malicious Python wheel. This wheel contains specially crafted entry-point names that use directory traversal or absolute paths. This allows pip to wri...
python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite
A flaw was found in pip, the package installer for Python. A remote attacker can exploit this vulnerability by tricking a victim into installing a malicious Python wheel. This wheel contains specially crafted entry-point names that use directory traversal or absolute paths. This allows pip to wri...
CGA-HP8V-363F-6JFP
Bulletin has no description...
Security update for 389-ds
This update for 389-ds fixes the following issues: Update to version 2.2.10git255.752643c78. Security issues fixed: CVE-2026-11610: missing bounds check in sasliorecv can lead to a heap buffer overflow when processing a specially crafted oversized LDAP UNBIND packet bsc1270695. CVE-2026-11611:...
CVE-2026-42566
Meshtastic is an open source mesh networking solution. Prior to version 2.7.23.b246bcd, a single node advertising a User.longname that contains a malformed character encoding can render other radios unusable over BLE when managed through the iOS app. The malformed name does not need to be...
Linux Distros Unpatched Vulnerability : CVE-2026-63913
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check An unintended behavior in the TCP conntrack state machine allows a...
Linux Distros Unpatched Vulnerability : CVE-2026-53390
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: fix out-of-bounds read in smbcheckpermdacl The permission-check ACE walk in smbcheckpermdacl validates the ACE header size and caps sid.numsubauth at...
Linux Distros Unpatched Vulnerability : CVE-2026-64106
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: arm64: vgic-its: Reject restored DTE with out-of-range numeventidbits Userspace can restore an ITS Device Table Entry whose Size field encodes more EventID...
CVE-2026-42566 Meshtastic: Malformed UTF-8 in User.long_name broadcast over LoRa causes mesh-wide client decode failure
Meshtastic is an open source mesh networking solution. Prior to version 2.7.23.b246bcd, a single node advertising a User.longname that contains a malformed character encoding can render other radios unusable over BLE when managed through the iOS app. The malformed name does not need to be...
CVE-2026-42566
The CVE affects Meshtastic firmware prior to 2.7.23.b246bcd where a single node advertising a User.long_name containing malformed UTF-8 over LoRa can render other radios unusable over BLE when managed via the iOS app. Root cause: a null terminator can be placed in the middle of a multibyte sequen...