1344 matches found
cisco-ios-xe-implant-scanner
Cisco IOS XE Implant Scanner On October 23, 2023, with all implants no longer responding to requests to /webui/logoutconfirm.html, Fox-IT developed a new way to determine if a system is compromised or not. In particular, instead of responding to requests with a redirect to the login, the attacker...
CVE-2026-126358 Hono: RegExpRouter skips wildcard middleware for some route sets and for paths with an encoded line terminator
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.1.4 until 4.13.16, RegExpRouter can omit wildcard middleware in three version-specific cases: since 4.13.0, middleware using the explicit default parameter pattern in /api/:tenant^/+/admin/ is not applied...
CVE-2026-126358
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.1.4 until 4.13.16, RegExpRouter can omit wildcard middleware in three version-specific cases: since 4.13.0, middleware using the explicit default parameter pattern in /api/:tenant^/+/admin/ is not applied...
Rocky Linux 8.6 [CIQ] Security Update: PackageKit / PackageKit-command-not-found / PackageKit-cron / etc Multiple Vulnerabilities (ciqsa-2026_1761)
The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261761 advisory. This advisory aggregates security fixes for the PackageKit SRPM in CIQ LTS 8.6. It addresses 2 CVEs: CVE-2026-41651, CVE-2018-1106. Tenable has extracted...
CVE-2026-98514
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix gem reference leak in validateinit On the ttmboreserve failure and "vma not found" error paths, the loop breaks without adding the looked-up object to any validate list, so the reference taken by drmgemobjectlook...
CVE-2026-98514 drm/nouveau: Fix gem reference leak in validate_init()
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix gem reference leak in validateinit On the ttmboreserve failure and "vma not found" error paths, the loop breaks without adding the looked-up object to any validate list, so the reference taken by drmgemobjectlook...
PT-2026-116733
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A reference leak occurs in the validate init function within the drm/nouveau component. When a ttm bo reserve failure or a "vma not found" error occurs, the loop terminates without addin...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: hwmon: Handle failure to register sensor with thermal zone correctly If an attempt is made to a sensor with a thermal zone and it fails, the call to devmthermalzoneofsensorregister may return -ENODEV. This may result in crashes...
Astra Linux – vulnerability in linux-5.10, linux-5.15, linux
In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: Clear nfctarget before being used Fix a slab-out-of-bounds read that occurs in nlaput called from nfcgenlsendtarget when target-sensbreslen, which is duplicated from an nfctarget in pn533, is too large as the nfctarge...
PT-2026-109494
Name of the Vulnerable Software and Affected Versions Download Manager versions prior to 3.3.59 Description Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecti...
CVE-2026-105215
ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields without a completed IdP callback. Unauthenticated attackers can submit forged...
EUVD-2026-92108
ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields without a completed IdP callback. Unauthenticated attackers can submit forged...
CVE-2026-105215
ZITADEL versions before 3.4.14 and 4.x before 4.16.2 are vulnerable to an authentication bypass within the hosted Login V1 UI . The root cause is that the 'external account not found' registration endpoint trusts client-supplied external identity fields without requiring a completed IdP callback ...
PT-2026-104639
ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields without a completed IdP callback. Unauthenticated attackers can submit forged...
CVE-2026-105215: Authentication Bypass by Spoofing
ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields without a completed IdP callback. Unauthenticated attackers can submit forged...
Rocky Linux 9.6 [CIQ] Security Update: PackageKit / PackageKit-command-not-found / PackageKit-glib / etc (ciqsa-2026_1340)
The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261340 advisory. This advisory aggregates security fixes for the PackageKit SRPM in CIQ LTS 9.6. It addresses 1 CVE: CVE-2026-41651. Tenable has extracted the preceding descriptio...
GHSA-P68Q-WCHP-6FH7 fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
Impact Fastify routes a malformed URL under one plugin prefix to the custom not-found handler of a different sibling plugin, invoking the handler registered last and skipping the preHandler declared in its setNotFoundHandler. When the request method has no route in the main router, a malformed...
NPM: fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
NPM: fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers vulnerability discovered by ? in WordPress Npm fastify versions = 4.0.0, 5.12.2...
fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
Impact Fastify routes a malformed URL under one plugin prefix to the custom not-found handler of a different sibling plugin, invoking the handler registered last and skipping the preHandler declared in its setNotFoundHandler. When the request method has no route in the main router, a malformed...