151374 matches found
Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments
...
USN-8595-1: Linux kernel (Oracle) vulnerabilities
It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. CVE-2025-54505 It was discovered that some AMD Zen 2 processors did not properly isolate shared...
USN-8574-2: Linux kernel vulnerabilities
It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. CVE-2025-54505 It was discovered that some AMD Zen 2 processors did not properly isolate shared...
.NET 9.0 security, bug fix, and enhancement update
An update is available for dotnet9.0. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list .NET is a managed-software framework. It implements a subset of the .NET...
BELL-CVE-2026-64600
Bulletin has no description...
EUVD-2026-47878
The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'parameter name' parameter in all versions up to, and including, 3.9.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
SUSE CVE-2026-63837
In the Linux kernel, the following vulnerability has been resolved: net: ena: PHC: Check return code before setting timestamp output enaphcgettimex64 is setting the output parameter regardless of whether enacomphcgettimestamp succeeded or failed. When enacomphcgettimestamp returns an error, the...
PT-2026-63610
Modals gallery paths could enumerate unintended directories...
libpq security update
16.14-1 - Rebase to upstream release 16.14 - Resolves: RHEL-192240...
PT-2026-63892
Contributor Cross Site Scripting XSS in Fluent Support = 2.3.0 versions...
PT-2026-64080
A vulnerability was found in bytedance InfiniStore up to 0.2.33. The impacted element is the function purge kv map in the library /src/infinistore.h of the component KV Map Handler. Performing a manipulation results in inefficient algorithmic complexity. The attack requires a local approach. The...
PT-2026-64121
PraisonAI Slack app mention bypasses configured user/channel authorization Summary PraisonAI's Slack bot applies its configured allowed users, allowed channels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack app mention event handler. A...
PT-2026-64103
Summary Pillow's TGA RLE encoder reads past its row buffer when saving a mode "1" image. Adjacent process heap bytes can be copied into the generated TGA file. The bug is reachable through the public save API: python im.saveout, format="TGA", compression="tga rle" Older affected Pillow versions u...
Linux InfiniBand Driver RCE
The vulnerability of the functions rxemralloc and rxemrinituser in the driver/infiniband/sw/rxe/rxemr.c module of the Linux operating system’s InfiniBand driver is related to the repeated release of previously released memory. Exploiting this vulnerability could allow an attacker to compromise th...
Linux kernel Heap Buffer Overflow DoS
The vulnerability of the ocxlfileregisterafu function in the drivers/misc/ocxl/file.c file of the Linux kernel is related to errors during link-time updates. Exploiting this vulnerability can allow an attacker to cause a service failure...
Oracle Linux 8 : httpd:2.4 (ELSA-2026-42828)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-42828 advisory. - Resolves: RHEL-173558 - httpd:2.4/httpd: Apache HTTP Server modproxyajp: Arbitrary code execution via heap-based buffer overflow CVE-2026-28780 -...
Oracle Linux 10 : kernel (ELSA-2026-19569)
The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-19569 advisory. - crypto: ccp - copy IV using skcipher ivsize CKI Backport Bot RHEL-188463 CVE-2026-53016 - futex/requeue: Revert 'Prevent NULL pointer dereference i...
Eclipse Jetty: HTTP Authority/Host mismatch
Summary Jetty currently accepts HTTP/2 and HTTP/3 requests where the regular Host header and the pseudo-header :authority do not match. As a result, the same request can carry two different host identities through Jetty: - logic based on HttpURI / Request.getServerNamerequest uses :authority -...
GHSA-FPG6-X68Q-5793 n8n: computer-use Shell Sandbox Not Enforced on Linux and Windows
Impact The shell tool in the @n8n/computer-use package applied its sandbox restrictions only on macOS. On Linux and Windows, shell commands executed by the tool ran without any filesystem or network restrictions, allowing unrestricted access to the host filesystem and network from within the...