23665 matches found
GHSA-8MV7-9C27-98VC
creationtimestamp| type| source ---|---|--- 2026-07-21 03:31:30+00:00| seen| https://gist.github.com/alon710/3baf3d34c51a96bcd4a3b1906aa0d17c...
PT-2026-62124
The CONFIG USERSPACE syscall verifier z vrfy k poll in kernel/poll.c allocates a kernel-side copy of the user-supplied k poll event via z thread malloc and then validates each event's object handle. Before this fix, validation used K OOPSK SYSCALL OBJ... inline inside the loop, which kills the...
CVE-2026-53594
creationtimestamp| type| source ---|---|--- 2026-07-20 22:06:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4cjglmhe2s...
EUVD-2026-39180
shell-quote: Quadratic-complexity Denial of Service in parse CWE-407...
EUVD-2026-40269
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding groups...
CVE-2026-53595
creationtimestamp| type| source ---|---|--- 2026-07-20 20:46:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr45zei2rd2u 2026-07-20 21:59:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4c4cmak22e 2026-07-20 22:00:43+00:00| seen|...
GHSA-499R-G7PC-VMP9
creationtimestamp| type| source ---|---|--- 2026-07-20 20:32:00+00:00| seen| https://gist.github.com/alon710/4520df6a85d072915e787e3825f8e5ef...
CVE-2026-64651
The CVE-2026-64651 entry concerns the @ai-sdk/harness-opencode tool that connects HarnessAgent to OpenCode via a sandboxed bridge. Before version 1.0.28, the tool would relay requests from any process whose command line included an allowed helper script path (host-tool-mcp.mjs), enabling untruste...
CVE-2026-64651 AI SDK OpenCode Harness Tool Relay Authorization Bypass
The @ai-sdk/harness-opencode tool connects HarnessAgent to OpenCode through a sandboxed bridge. Prior to version 1.0.28, the tool relay authorizes requests from any process whose command line contains an allowed helper script path host-tool-mcp.mjs. This allows untrusted code executing in the...
GHSA-GCJP-F7JM-RRRG
creationtimestamp| type| source ---|---|--- 2026-07-20 19:01:01+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mr3y5jeb5l2e...
GHSA-C98P-7WGM-6P64 Tornado: Quadratic DoS via Repeated Header Coalescing
Summary The HTTPHeaders.add method in Tornado accumulates values using string concatenation when the same header name is repeated. Due to Python string immutability, each concatenation copies the entire string, resulting in On² time complexity. Given Tornado's single event loop architecture, a...
Tornado: Quadratic DoS via Repeated Header Coalescing
Summary The HTTPHeaders.add method in Tornado accumulates values using string concatenation when the same header name is repeated. Due to Python string immutability, each concatenation copies the entire string, resulting in On² time complexity. Given Tornado's single event loop architecture, a...
CVE-2026-57366
creationtimestamp| type| source ---|---|--- 2026-07-20 18:44:09+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mr3x7e2xlx2e 2026-07-21 04:44:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mr4yq7e34e2o 2026-07-21 14:44:09+00:00| seen|...
CVE-2026-51385
creationtimestamp| type| source ---|---|--- 2026-07-20 18:00:05+00:00| seen| Telegram/WNPKjULv0ephKNyiWQmiLebMVhKs5Yq19I9tIqi1CZzDTIM 2026-07-21 00:00:32+00:00| seen| Telegram/WNPKjULv0ephKNyiWQmiLebMVhKs5Yq19I9tIqi1CZzDTIM 2026-07-22 00:00:07+00:00| published-proof-of-concept|...
CVE-2026-57356
creationtimestamp| type| source ---|---|--- 2026-07-20 16:44:10+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mr3qiss5gu2n 2026-07-21 02:44:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mr4rzmvp3q2j 2026-07-21 12:44:08+00:00| seen|...
aap-gateway: missing requestHeadersToRemove allows mTLS bypass via Subject header spoofing
A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP header from client requests, despite the source code defining requestHeadersToRemove for this header. An unauthenticated remote attacker can inject a spoofed...
CVE-2026-57349
creationtimestamp| type| source ---|---|--- 2026-07-20 14:44:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mr3js6prby2q 2026-07-21 00:44:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mr4lczxpok23 2026-07-21 10:44:09+00:00| seen|...
CVE-2026-12970
creationtimestamp| type| source ---|---|--- 2026-07-20 08:55:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr2wc3gzwr2i...
CERTFR-2026-ACT-031
creationtimestamp| type| source ---|---|--- 2026-07-20 08:34:42+00:00| seen| https://bsky.app/profile/infosecfr.skyfleet.blue/post/3mr2v5ko7qq2g 2026-07-20 08:51:10+00:00| seen| https://bsky.app/profile/cert-fr.bsky.social/post/3mr2w2zlyeq2b 2026-07-20 08:51:16+00:00| seen|...