66742 matches found
CVE-2026-84645
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level configuration files in Jenkins such as the global configuration and jobs can appear as nested field values in user-submitted config.xml documents and subsequently...
EUVD-2026-70207
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. Th...
CVE-2026-20280 Cisco IOS XR Software Security Hardening Release: September 2026
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. Th...
DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution
A flaw was found in DBI, a Perl database interface. This vulnerability allows an attacker to trigger a buffer overflow by manipulating error messages within an application. When specific error handling options are active, an attacker can provide oversized error text, which may lead to arbitrary...
CVE-2025-15489 Passster < 4.2.24 - Password Protection Bypass
The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content...
CVE-2026-73476
Improper Handling of Case Sensitivity vulnerability in Drupal External Authentication allows Privilege Escalation. This issue affects External Authentication versions: from 0.0.0 to 2.0.13...
CVE-2026-73476 External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098
Improper Handling of Case Sensitivity vulnerability in Drupal External Authentication allows Privilege Escalation. This issue affects External Authentication versions: from 0.0.0 to 2.0.13...
RLSA-2026:61377 Important: nodejs24 security, bug fix, and enhancement update
Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...
CVE-2026-84357
An improper input validation flaw was found in the Omnibox component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=523208474 Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Produc...
PT-2026-86456
Name of the Vulnerable Software and Affected Versions RouterOS versions prior to 6.49.21 RouterOS versions prior to 7.23.4 RouterOS versions prior to 7.24.2 Description An argument-handling flaw exists in the SSH login path when usernames begin with a prohibited character. This allows an...
CVE-2026-84372
Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, pipeline handling on aggregate cluster and replication connections reparses an already serialized RESP buffer in AbstractAggregateConnection::write by splitting it with...
CVE-2026-84639
Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2...
CVE-2026-84372 Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections
Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, pipeline handling on aggregate cluster and replication connections reparses an already serialized RESP buffer in AbstractAggregateConnection::write by splitting it with...
CVE-2026-84372
Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, pipeline handling on aggregate cluster and replication connections reparses an already serialized RESP buffer in AbstractAggregateConnection::write by splitting it with...
CVE-2026-63435
Mail is an internet library for Ruby designed to handle email generation, parsing, and sending. Prior to 2.9.1, Mail::Utilities.qvaluedecode and Mail::Utilities.bvaluedecode used a single Stringmatch and an overly greedy charset capture to decode only the first RFC 2047 encoded-word and mishandle...
nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service
A heap use-after-free vulnerability in the Node.js HTTP/2 component allows a remote attacker to crash the application, causing a denial of service. This is triggered by an unexpected re-entrant call to nghttp2sessionmemsend while nghttp2sessionmemrecv is still executing...
CVE-2026-73720 Authenticated Insecure File Handling allows Remote Code Execution in HPE Networking Fabric Composer API
Insecure file operations in the API of HPE Networking Fabric Composer could allow an authenticated remote attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system...
CVE-2026-73720
HPE Networking Fabric Composer contains insecure file operations in its API that could allow an authenticated remote attacker to achieve remote code execution . Successful exploitation permits an attacker to execute arbitrary commands as a privileged user on the underlying operating system, resul...