net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

CVE-2026-9854

A vulnerability in the SYS600 RBAC mechanism (by Hitachi Energy ) allows users with access to the engineering tools to elevate privileges to administrator level on the underlying Windows host , granting themselves full control over the machine. The CVSS 4.0 score is 8.5 (HIGH) , with a local atta...

CVE-2026-9854

A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could elevate their privileges to administrator level on the underlying Windows host, granting themselves full control over the host machine...

EUVD-2026-70319

A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could elevate their privileges to administrator level on the underlying Windows host, granting themselves full control over the host machine...

DEBIAN-CVE-2026-84394

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse returns it as the ho...

CVE-2026-84394

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse returns it as the ho...

PT-2026-85031

Name of the Vulnerable Software and Affected Versions VMware Workstation versions 25H2 through 26H1 VMware Fusion versions 25H2 through 26H1 Description An integer overflow exists in the VMXNET3 virtual network adapter within the hypervisor. A malicious actor with local administrative privileges...

Linux Distros Unpatched Vulnerability : CVE-2026-84394

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but do...

Linux Distros Unpatched Vulnerability : CVE-2026-84292

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port...

EUVD-2026-63465

Hurl: Cookies in Cookies section leak when redirecting to a different host...

GHSA-P8RW-8QJ3-HF33 Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE

Summary An authenticated, non-admin user can obtain arbitrary host-filesystem read/write and host environment-secret disclosure on an Omnigent runner by uploading an agent bundle whose osenv.cwd points outside any intended workspace e.g. / or /home/. The cwd field is taken verbatim from the bundl...

CVE-2026-84394

A flaw was found in fast-uri. The library incorrectly processes Uniform Resource Identifier URI hosts containing unbalanced brackets, leading to a discrepancy in how the host is parsed by fast-uri compared to other HTTP clients. This host confusion can allow an attacker to bypass security policie...

CVE-2026-84394 fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse returns it as the ho...

CVE-2026-84394 fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse returns it as the ho...

CVE-2026-84394

fast-uri (a URI parsing library used by the Fastify ecosystem) contains a host confusion vulnerability: when a URI's authority contains an opening bracket [ without a matching closing bracket ], parse() returns the string as the host without error. Neither an IP literal nor a valid domain name is...

CVE-2026-84394

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse returns it as the ho...

CVE-2026-84292

fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject authority delimiters, demoting the intended host t...

CVE-2026-84292 fast-uri vulnerable to authority injection via an unvalidated port in serialize

fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject authority delimiters, demoting the intended host t...

CVE-2026-84292

fast-uri , a URI library in the Fastify ecosystem, fails to validate the port component when serializing an authority. The recomposeAuthority function concatenates the port verbatim without escaping, so a crafted non-digit value (e.g., containing @) can inject authority delimiters, demoting the i...

CVE-2026-79755

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, on the Nuclio local Docker platform, the function namespace is interpolated—unvalidated—into a double-quoted docker ps --filter "label=nuclio.io/namespace=" command that is executed via the host...