Lucene search
+L

45072 matches found

Tenable Nessus
Tenable Nessus
•added 2026/09/15 12:00 a.m.•12 views

RockyLinux 8 : gstreamer1-plugins-base (RLSA-2026:67145)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:67145 advisory. gstreamer1-plugins-base: gstreamer: NULL/invalid-pointer dereference in gstrtspmessageparseauthcredentials when parsing a crafted Digest...

7.5CVSS7.2AI score0.0053EPSS
SaveExploits0References3
Tenable Nessus
Tenable Nessus
•added 2026/09/15 12:00 a.m.•9 views

Linux Distros Unpatched Vulnerability : CVE-2026-79699

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header e.g. victim/.wh. can cause the extraction...

4.4CVSS5.7AI score0.00173EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/09/15 12:00 a.m.•20 views

PT-2026-92038

Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling...

9CVSS5.7AI score0.00352EPSS
SaveExploits0References3
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/09/15 12:00 a.m.•2 views

CVE-2026-92238: Inconsistent Interpretation of HTTP Requests

A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3...

9.8CVSS5.9AI score0.00539EPSS
SaveExploits0References5
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/09/15 12:00 a.m.•1 views

CVE-2026-54254: Improper Input Validation

Cyberdrop-DL is a bulk asynchronous downloader for multiple file hosts. From 8.5.0 until 9.14.0, the Pixeldrain crawler uses substring host matching instead of requiring the input host to be an exact member of SUPPORTEDDOMAINS, and then reuses that input host for API requests. When a Pixeldrain A...

5.9CVSS5.6AI score0.00528EPSS
SaveExploits0References3
Mozilla
Mozilla
•added 2026/09/15 12:00 a.m.•16 views

Security Vulnerabilities fixed in Thunderbird 156 — Mozilla

A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. A maliciously constructed IMAP line could cause an out-of-bounds buffer read. A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP respon...

9.8CVSS6.1AI score0.00628EPSS
SaveExploits0References75Affected Software1
Tenable Nessus
Tenable Nessus
•added 2026/09/15 12:00 a.m.•9 views

Linux Distros Unpatched Vulnerability : CVE-2026-84445

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer allow internal/transport/http2server.go to...

8.7CVSS5.8AI score0.00641EPSS
SaveExploits0References3
Mozilla
Mozilla
•added 2026/09/15 12:00 a.m.•11 views

Security Vulnerabilities fixed in Thunderbird 140.16 — Mozilla

A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. A maliciously constructed IMAP line could cause an out-of-bounds buffer read. A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP respon...

9.8CVSS6.1AI score0.00628EPSS
SaveExploits0References31Affected Software1
Tenable Nessus
Tenable Nessus
•added 2026/09/15 12:00 a.m.•10 views

Linux Distros Unpatched Vulnerability : CVE-2024-58384

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request...

6.3CVSS6.1AI score0.00242EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/09/15 12:00 a.m.•11 views

PT-2026-92039

Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests...

6.3CVSS6AI score0.00242EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/09/15 12:00 a.m.•14 views

PT-2026-92037

Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain...

9CVSS5.9AI score0.00367EPSS
SaveExploits0References3
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/09/15 12:00 a.m.•1 views

CVE-2023-54397: Inconsistent Interpretation of HTTP Requests

Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain...

9CVSS5.9AI score0.00367EPSS
SaveExploits0References2
NVD
NVD
•added 2026/09/14 9:17 p.m.•13 views

CVE-2026-90819

A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSender.dispatchNotification of the file server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java of the component Authorization Header...

7.5CVSS0.00661EPSS
SaveExploits0References9
Cvelist
Cvelist
•added 2026/09/14 9:15 p.m.•33 views

CVE-2026-12758 Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.

IBM Cloud Pak for Business Automation could allow a remote attacker to bypass authorization and invoke restricted endpoints due to improper validation of HTTP headers...

5.4CVSS0.00182EPSS
SaveExploits0References1
OSV
OSV
•added 2026/09/14 8:38 p.m.•9 views

CVE-2026-81901 Concrete CMS 9.2.0 to 9.5.2 is vulnerable to stored XSS due to missing authorization in the `PUT /pages/{cID}` endpoint

In Concrete CMS 9.2.0 through 9.5.2, the REST API page update endpoint PUT /ccm/api/1.0/pages/cID did not enforce page-property, page-template, or page-type authorization. A user granted only content-editing rights on a page could therefore alter its properties, template, and type through the API...

7.2CVSS5.8AI score
SaveExploits0References4
OSV
OSV
•added 2026/09/14 8:30 p.m.•14 views

CVE-2026-90819 a2aproject a2a-java Authorization Header Construction BasePushNotificationSender.java BasePushNotificationSender.dispatchNotification response splitting

A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSender.dispatchNotification of the file server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java of the component Authorization Header...

6.9CVSS5.3AI score
SaveExploits0References11
Vulnrichment
Vulnrichment
•added 2026/09/14 8:30 p.m.•16 views

CVE-2026-90819 a2aproject a2a-java Authorization Header Construction BasePushNotificationSender.java BasePushNotificationSender.dispatchNotification response splitting

A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSender.dispatchNotification of the file server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java of the component Authorization Header...

7.5CVSS6.8AI score0.00661EPSS
SaveExploits0References9
CVE
CVE
•added 2026/09/14 8:30 p.m.•18 views

CVE-2026-90819

A remote HTTP response splitting vulnerability exists in a2aproject a2a-java 1.2.0 , specifically in the BasePushNotificationSender.dispatchNotification function (file: server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java) within the Authorization Header Con...

7.5CVSS6.8AI score0.00661EPSS
SaveExploits0References9
EUVD
EUVD
•added 2026/09/14 8:30 p.m.•14 views

EUVD-2026-78085

A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSender.dispatchNotification of the file server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java of the component Authorization Header...

7.5CVSS6.8AI score0.00661EPSS
SaveExploits0References9
Cvelist
Cvelist
•added 2026/09/14 8:30 p.m.•31 views

CVE-2026-90819 a2aproject a2a-java Authorization Header Construction BasePushNotificationSender.java BasePushNotificationSender.dispatchNotification response splitting

A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSender.dispatchNotification of the file server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java of the component Authorization Header...

7.5CVSS0.00661EPSS
SaveExploits0References9
Rows per page
Query Builder