GHSA-VH8F-65QG-3M8J Duplicate Advisory: .NET Denial of Service Vulnerability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4vgm-c2wm-63mw. This link is maintained to preserve external references. Original Description Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service...

com.vaadin:vaadin-platform-test (10.0.9), org.rapidpm:rapidpm-vaadin-testbench-ng-m-framework-v10 (>=01.00.00-rpm, <=01.00.01-rpm) +1 more potentially affected by CVE-2026-2742 via com.vaadin:vaadin (10.0.9)

com.vaadin:vaadin MAVEN version 10.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:vaadin and may be impacted: - com.vaadin:vaadin-platform-test 10.0.9 - org.rapidpm:rapidpm-vaadin-testbench-ng-m-framework-v10 =01.00.00-rpm, =01.00.00-rp...

com.vaadin:vaadin-platform-test (10.0.10), org.rapidpm:rapidpm-vaadin-testbench-ng-m-framework-v10 (>=01.00.02-rpm, <=01.00.03-rpm) +1 more potentially affected by CVE-2026-2742 via com.vaadin:vaadin (10.0.10)

com.vaadin:vaadin MAVEN version 10.0.10 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:vaadin and may be impacted: - com.vaadin:vaadin-platform-test 10.0.10 - org.rapidpm:rapidpm-vaadin-testbench-ng-m-framework-v10 =01.00.02-rpm,...

com.vaadin:vaadin-platform-test (10.0.2), org.rapidpm.vaadin:rapidpm-vaadin-cdi-m-integration-tests (00.07.04-rpm) +4 more potentially affected by CVE-2026-2742 via com.vaadin:vaadin (10.0.2)

com.vaadin:vaadin MAVEN version 10.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:vaadin and may be impacted: - com.vaadin:vaadin-platform-test 10.0.2 - org.rapidpm.vaadin:rapidpm-vaadin-cdi-m-integration-tests 00.07.04-rpm -...

org.rapidpm:testbench-ng-m-framework-v10 (>=00.07.05-rpm, <=00.07.06-rpm), org.rapidpm:testbench-ng-m-pageobject-vaadin-v10-oss (>=00.07.05-rpm, <=00.07.06-rpm) +1 more potentially affected by CVE-2026-2742 via com.vaadin:vaadin (10.0.6)

com.vaadin:vaadin MAVEN version 10.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:vaadin and may be impacted: - org.rapidpm:testbench-ng-m-framework-v10 =00.07.05-rpm, =00.07.05-rpm, =00.07.05-rpm, =00.07.06-rpm Source cves: CVE-2026-27...

EUVD-2026-10696

Incorrect default permissions in .NET allows an authorized attacker to elevate privileges locally...

EUVD-2026-10694

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network...

CVE-2026-2742

An authentication bypass vulnerability exists in Vaadin 14.0.0 through 14.14.0, 23.0.0 through 23.6.6, 24.0.0 through 24.9.7 and 25.0.0 through 25.0.1, applications using Spring Security due to inconsistent path pattern matching of reserved framework paths. Accessing the /VAADIN endpoint without ...

CVE-2026-30964

The connected GHSA entry describes a concrete vulnerability in Webauthn Framework: when allowed_origins is configured, CheckAllowedOrigins reduces URL-like origins to their host, causing mismatched origins (scheme/port) to be treated as the same host. This bypasses the strict origin validation re...

CVE-2026-30964 Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation

web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. Prior to 5.2.4, when allowedorigins is configured, CheckAllowedOrigins reduces URL-like values to their host component and...

CVE-2026-30964 Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation

web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. Prior to 5.2.4, when allowedorigins is configured, CheckAllowedOrigins reduces URL-like values to their host component and...

CVE-2026-30964 Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation

web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. Prior to 5.2.4, when allowedorigins is configured, CheckAllowedOrigins reduces URL-like values to their host component and...

CVE-2026-26130

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network...

CVE-2026-26127

Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network...

CVE-2026-26131 .NET Elevation of Privilege Vulnerability

...

CVE-2026-26131

Incorrect default permissions in .NET allows an authorized attacker to elevate privileges locally...

2026-03 .NET 8.0.25 Security Update for x64 Client (KB5081277)

2026-03 .NET 8.0.25 Security Update for x64 Client KB5081277...

2026-03 .NET 8.0.25 Security Update for x86 Client (KB5081277)

2026-03 .NET 8.0.25 Security Update for x86 Client KB5081277...

CVE-2026-30942 Flare has a Path Traversal in /api/avatars/[filename]

Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Prior to 1.7.3, an authenticated path traversal vulnerability in /api/avatars/filename allows any logged-in user to read arbitrary files from within the application container. The filename URL...

Security update for python-aiohttp

This update for python-aiohttp fixes the following issues: CVE-2025-69228: Fixed denial of service through large payloads bsc1256022. CVE-2025-69226: Fixed brute-force leak of internal static file path components bsc1256020. CVE-2025-69224: Fixed unicode processing of header values could cause...