400494 matches found
PT-2026-108109
Name of the Vulnerable Software and Affected Versions JHipster versions 7.0.0 through 9.3.x Description Reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database are susceptible to SQL injection. The issue occurs because the sort request parameter in paginated...
PT-2026-108250
Name of the Vulnerable Software and Affected Versions fast-jwt versions 1.5.1 through 6.2.x Description The createVerifier function fails to properly validate the clockTolerance option, accepting Infinity as a valid input. This occurs because the validation logic only checks if the value is a...
CVE-2026-107315
pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pads a value that is shorter than its declared length with bytes left in its send buffer instead of zeros, and the server stores those bytes as part of the value. The bytes are messages the driver sent earlier on the same...
PT-2026-107820
Name of the Vulnerable Software and Affected Versions Brocade Fabric OS versions prior to 9.2.2d Brocade Fabric OS versions 10.0.0 through 10.0.0a1 Description An authenticated user with permissions to perform configuration downloads using remote server profiles can execute arbitrary shell comman...
EulerOS 2.0 SP15 : glib2 (EulerOS-SA-2026-3976)
According to the versions of the glib2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in GLib. An off-by-one error can occur in the gkeyfilegetlocalestringlist function in the gkeyfile.c file when loading a key file...
EulerOS 2.0 SP15 : EDK2 (EulerOS-SA-2026-3960)
According to the versions of the EDK2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitivex000D element whose content exceeds 2 gigabytes in length may cause a he...
EulerOS 2.0 SP15 : python-jwt (EulerOS-SA-2026-3942)
According to the versions of the python-jwt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit Critical Header Parameter defined in RFC...
Python Library Django 5.2.x < 5.2.18 / 6.0.x < 6.0.9 / 6.1.x < 6.1.2 Multiple Vulnerabilities
The detected version of the Django Python package is 5.2.x prior to 5.2.18, or 6.0.x prior to 6.0.9, or 6.1.x prior to 6.1.2. It is, therefore, affected by multiple vulnerabilities, including: - django.utils.translation.getsupportedlanguagevariant is subject to a potential denial-of-service attac...
EulerOS 2.0 SP15 : EDK2 (EulerOS-SA-2026-3894)
According to the versions of the EDK2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitivex000D element whose content exceeds 2 gigabytes in length may cause a he...
RHEL 6 : dracut (RHSA-2026:79114)
The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:79114 advisory. The dracut packages contain an event-driven initial RAM file system initramfs generator infrastructure based on the udev device manager. Th...
PT-2026-108709
Summary SkillTools.run skill script accepts a script path parameter and executes it via subprocess.run without any path containment validation. While FileTools has validate path with traversal detection, SkillTools performs none. An LLM-directed call can execute arbitrary scripts from any...
PT-2026-108651
Description On the zero-configuration TLS path, the connector accepts a self-signed server certificate at the TLS level and then validates the server's identity from the fingerprint hash the server appends to the final OK Packet Authentication.validateFingerPrint. That validation calls hash on th...
PT-2026-108146
Name of the Vulnerable Software and Affected Versions MariaDB Connector/Node.js versions prior to 3.2.5 MariaDB Connector/Node.js versions prior to 3.3.4 MariaDB Connector/Node.js versions prior to 3.4.7 MariaDB Connector/Node.js versions prior to 3.5.4 Description When encoding GeoJSON Polygon a...
PT-2026-108045
Name of the Vulnerable Software and Affected Versions Pydantic AI versions 1.77.0 through 1.107.5 Pydantic AI versions prior to 2.44.0 Description The local web fetch tool and the WebFetch local fallback process server-controlled responses using operations that grow quadratically relative to the...
PT-2026-107785
An input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versions before 10.0.1. When configuring Federated Authentication FA, the system fails to sanitize the Identity Provider IdP issuer parameter. An authenticated administrator—or an...
EulerOS 2.0 SP15 : glib2 (EulerOS-SA-2026-3910)
According to the versions of the glib2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in GLib. An off-by-one error can occur in the gkeyfilegetlocalestringlist function in the gkeyfile.c file when loading a key file...
EulerOS 2.0 SP15 : vim (EulerOS-SA-2026-3957)
According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Vim is an open source, command line text editor. Prior to version 9.2.0565, the updatesnapshot function in src/terminal.c copies the visible terminal...
UBUNTU-CVE-2026-107315
pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pads a value that is shorter than its declared length with bytes left in its send buffer instead of zeros, and the server stores those bytes as part of the value. The bytes are messages the driver sent earlier on the same...
EulerOS 2.0 SP15 : python3 (EulerOS-SA-2026-4012)
According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : unicodedata.normalize can take excessive CPU time when processingx000D specially crafted Unicode input containing long runs of combining...
PT-2026-108128
QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminHotelRoomsBookingController::postProcess that allows restricted back-office employees to access other hotels' data by supplying an id hotel parameter. Attackers can modify the id hotel URL parameter on the Book Now page ...