212104 matches found
CVE-2026-73513: Improper Input Validation
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's optional oghttp2 upstream HTTP/2 codec accepts a response trailer HEADERS frame without ENDSTREAM. Envoy completes and deferred-deletes the ActiveRequest...
CVE-2026-94379: Improper Input Validation
The login function in MISP's UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allowlist approach, checking only for specific HTTP methods POST and PUT before enforcing bruteforce protection, email one-time-passwo...
CVE-2026-73513: Improper Input Validation
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's optional oghttp2 upstream HTTP/2 codec accepts a response trailer HEADERS frame without ENDSTREAM. Envoy completes and deferred-deletes the ActiveRequest...
CVE-2026-73547: Improper Input Validation
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's extauthz filter assumes that a request contains a :path pseudoheader when applying queryparameterstoset or queryparameterstoremove from an authorization...
ROS-20260921-73-0081
The vulnerability is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to cause service failures...
CVE-2026-73552: Improper Input Validation
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy HTTP RBAC accepts RFC-valid opaque header bytes but evaluates saferegex values with RE2's UTF-8 subject semantics. A downstream client can preserve a prohibit...
CVE-2026-73552: Improper Input Validation
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy HTTP RBAC accepts RFC-valid opaque header bytes but evaluates saferegex values with RE2's UTF-8 subject semantics. A downstream client can preserve a prohibit...
ROS-20260921-73-0041
The vulnerability in the kernel-lt is related to errors in processing input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
EUVD-2026-84189
FalkorDB Redis module v4.20.1 to v4.20.4 was discovered to contain a buffer overflow in the DecodeGrBMatrix function /v19/decodematrix.c. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted input...
ROS-20260921-73-0094
The vulnerability is related to insufficient checking of unusual or exceptional states. Exploiting this vulnerability can allow a remote attacker to cause service failures...
RHEL 8 : libxml2 (RHSA-2026:69655)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:69655 advisory. The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: mingw-libxml2: libxml2:...
OpenSSL ocsp_responders() function Data Compromise
The vulnerability of the ocspresponers function in the openssl/src/x509/mod.rs library of the OpenSSL library is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of the protected information...
TOTOLINK A3300R SetVpnPassCfg Command Execution
The vulnerability of the setVpnPassCfg function in TOTOLINK A3300R router microprogramming software is related to the lack of measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
Oracle Linux 10 : tomcat (ELSA-2026-69259)
The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-69259 advisory. - Resolves: RHEL-192817 tomcat: HTTP/2 request headers not validated CVE-2026-41293 - Resolves: RHEL-192648 tomcat: Improper Input Validation...
Exploit for Improper Input Validation in Microsoft
CVE-2023-21554 — QueueJumper PoC Proof of concept for CVE-2...
Exploit for Improper Input Validation in Pyyaml
CVE-2020-14343 – PyYAML Unsafe YAML Loading Lab 1. Project...
SUSE CVE-2026-93337
NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains an improper input validation vulnerability that allows local users with VPN connection creation permissions to inject arbitrary pppd directives by supplying mru or mtu property values containing trailing non-numeric content after a val...
Cross-site Scripting (XSS)
Semantic MediaWiki is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to attacker-controlled query input being reflected into raw HTML without proper output encoding, which allows an unauthenticated attacker to inject malicious scripts through a crafted query and execute them in ...
