27 matches found
CVE-2026-81638
Improper Handling of Alternate Encoding vulnerability in ash-project ashdoubleentry allows an attacker to submit several distinct string spellings of the same identifier. AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3 bits, so...
CVE-2026-81638 Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry
Improper Handling of Alternate Encoding vulnerability in ash-project ashdoubleentry allows an attacker to submit several distinct string spellings of the same identifier. AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3 bits, so...
CVE-2026-81638 Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry
Improper Handling of Alternate Encoding vulnerability in ash-project ashdoubleentry allows an attacker to submit several distinct string spellings of the same identifier. AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3 bits, so...
EEF-CVE-2026-81638 Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry
Summary Improper Handling of Alternate Encoding vulnerability in ash-project ashdoubleentry allows an attacker to submit several distinct string spellings of the same identifier. AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3...
EUVD-2026-72541
Improper Handling of Alternate Encoding vulnerability in ash-project ashdoubleentry allows an attacker to submit several distinct string spellings of the same identifier. AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3 bits, so...
CVE-2026-81638 Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry
Improper Handling of Alternate Encoding vulnerability in ash-project ashdoubleentry allows an attacker to submit several distinct string spellings of the same identifier. AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3 bits, so...
PT-2026-86922
Improper Handling of Alternate Encoding vulnerability in ash-project ash double entry allows an attacker to submit several distinct string spellings of the same identifier. AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3 bits, ...
CVE-2026-81638: Improper Handling of Alternate Encoding
Improper Handling of Alternate Encoding vulnerability in ash-project ashdoubleentry allows an attacker to submit several distinct string spellings of the same identifier. AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3 bits, so...
Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098756)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098756 advisory. In the Linux kernel, the following vulnerability has been resolved: schhfsc: make hfscqlennotify idempotent hfscqlennotify is not idempotent either and not friendly ...
Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102088)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102088 advisory. In the Linux kernel, the following vulnerability has been resolved: schhfsc: make hfscqlennotify idempotent hfscqlennotify is not idempotent either and not friendly ...
This Week in Spring - August 4th, 2026
Hi, Spring fans! Welcome to another installment of This Week in Spring! It's the 4th of August! We're already in month eight of this year! Great Scott! This is an interesting project to help ensure idempotency keys for Spring Boot requests A very interesting post on The New Stack titled, When...
CVE-2026-34210 mppx has Stripe charge credential replay via missing idempotency check
mppx is a TypeScript interface for machine payments protocol. Prior to version 0.4.11, the stripe/charge payment method did not check Stripe's Idempotent-Replayed response header when creating PaymentIntents. An attacker could replay a valid credential containing the same spt token against a new...
CVE-2026-34210 mppx has Stripe charge credential replay via missing idempotency check
mppx is a TypeScript interface for machine payments protocol. Prior to version 0.4.11, the stripe/charge payment method did not check Stripe's Idempotent-Replayed response header when creating PaymentIntents. An attacker could replay a valid credential containing the same spt token against a new...
CVE-2026-34210 mppx has Stripe charge credential replay via missing idempotency check
mppx is a TypeScript interface for machine payments protocol. Prior to version 0.4.11, the stripe/charge payment method did not check Stripe's Idempotent-Replayed response header when creating PaymentIntents. An attacker could replay a valid credential containing the same spt token against a new...
Replay Attack
Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Replay Attack via the voice-call webhook process. An attacker can cause replayed webhook events to be accepted as new by modifying the i-twilio-idempotency-token header in a signed reques...
PT-2026-25458
Summary The voice-call Twilio webhook path accepted replay/dedupe identity from unsigned request metadata i-twilio-idempotency-token, enabling replayed signed requests to bypass replay detection and manager dedupe by mutating only that header. Affected Packages / Versions - Package: openclaw npm ...
CVE-2025-38177: Incomplete Cleanup
In the Linux kernel, the following vulnerability has been resolved: schhfsc: make hfscqlennotify idempotent hfscqlennotify is not idempotent either and not friendly to its callers, like fqcodeldequeue. Let's make it idempotent to ease qdisctreereducebacklog callers' life: 1. updatevf decreases...
CVE-2025-37932: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: schhtb: make htbqlennotify idempotent htbqlennotify always deactivates the HTB class and in fact could trigger a warning if it is already deactivated. Therefore, it is not idempotent and not friendly to its callers, like...
PT-2025-27950
Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue concerns the hfsc qlen notify function in the Linux kernel, which is not idempotent and can cause problems for its callers, such as fq codel dequeue. To address this, changes...
