4268 matches found
CVE-2026-94194 Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediaries
Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize an intermediary and the Mint client on a pooled connection, poisoning the responses to subsequent requests that share the connection...
EEF-CVE-2026-94194 Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediaries
Summary Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize an intermediary and the Mint client on a pooled connection, poisoning the responses to subsequent requests that share the...
EUVD-2026-88219
Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to make the client hold up to about 16 MiB per connection in frames it should reject, consuming client memory. Mint.HTTP2.Frame.decodenext/2 in lib/mint/http2/frame.ex compares ...
CVE-2026-18416: Out-of-bounds Read
The CoAP link-format helper matchpathuri in subsys/net/lib/coap/coaplinkformat.c compares a registered resource path against the URI carried in a Uri-Query href= option. That URI is not NUL terminated, but the inner character loop advanced its index k once per path character without ever testing ...
CVE-2026-101905: Unintended Proxy or Intermediary
Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value. A separate same-process prototype-pollution flaw places a function on...
jenkinsci__workflow-cps-global-lib-plugin_CVE-2022-25174_544-vff04fa68714d
파이프라인 공유 라이브러리 여러 개의 파이프라인 작업이 있을 때, 파이프라인 스크립트를 DRY하게 유지하기 위해 스크립트의 일부를 공유하고 싶은 경우가 많습니다. 매우 일반적인 사용 사례는 비슷한 방식으로 빌드되는 많은 프로젝트가 있는 경우입니다. 이 플러그인은 '공유 라이브러리 스크립트' SCM 저장소를 생성할 수 있도록 하여 해당 기능을 추가합니다. 두 가지 모드로 사용할 수 있습니다: Jenkins 자체에서 호스팅하는 단일 Git 저장소가 있어 변경 사항을 푸시할 수 있는 레거시 모드 원하는 위치의 모든 SCM에서 호스팅...
CVE-2026-90781-alsa-lib-oob
CVE-2026-90781 — alsa-lib 越界写入复现程序 针对 CVE-2026-90781 的独立 C 语言复现程序，该漏洞是 alsa-lib 的 sndctlasciielemidparse 在解析 name=（带引号和不带引号两种形式）时发生的 1 字节越界写入。 漏洞详情 在 src/control/ctlparse.c（v1.2.16.1 及更早的开发版 HEAD）中： char buf64; ... if size intsizeofbuf // BUG: allows size == 64 ptr++ = str; size++; ... ptr = '\0'...
CVE-2026-100721 vm2 before 3.12.2 Authorization Bypass via Custom Resolver
vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures require.external with a custom resolver and context: 'host', LegacyResolver.customResolve in lib/resolver-compat.js records the resolved module directory in this.externals as new...
CVE-2026-100713 Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync
Froxlor 2.3.10 and earlier contain a time-of-check time-of-use TOCTOU race condition in the SSH key synchronization cron lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles. The containment/symlink validation performed by FileDir::makeCorrectDir/makeCorrectFile is done only at check time;...
CVE-2026-100713 Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync
Froxlor 2.3.10 and earlier contain a time-of-check time-of-use TOCTOU race condition in the SSH key synchronization cron lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles. The containment/symlink validation performed by FileDir::makeCorrectDir/makeCorrectFile is done only at check time;...
Malicious code in @zeronexcode/baileys (npm)
makeWASocket in lib/Socket/index.js makes the user's WhatsApp account follow the hardcoded channel 120363427099186895@newsletter whenever a connection opens, with no option to disable it...
MAL-2026-17326 Malicious code in @zeronexcode/baileys (npm)
makeWASocket in lib/Socket/index.js makes the user's WhatsApp account follow the hardcoded channel 120363427099186895@newsletter whenever a connection opens, with no option to disable it...
EUVD-2026-86479
IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL. The generatecertificate runs a Python script saved as a certificate file. The pyhton script attempts to retrieve code from a hardcoded http URL that is obfuscated with base6...
curl: [HIGH] CWE-22 — Path Traversal in FTP Wildcard Download via Unencoded `.` in Escaped Filenames
Summary A malicious or MITM'd FTP server can cause a client using CURLOPTWILDCARDMATCH to download files outside the intended remote directory, by returning a LIST response with a filename containing .. path-traversal sequences. Details In the CURLWCDOWNLOADING state lib/ftp.c:4079-4095, each...
SUSE CVE-2026-96674
alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowing integer overflow that defeats bounds checks. Attackers can supply crafted topology files that wrap size calculations, causing the decoder to read beyond the topology buffer an...
SUSE CVE-2026-96675
alsa-lib through 1.2.16.1 contains a denial of service vulnerability in the multi PCM plugin that fails to validate sparse binding indices before array access. Attackers can supply a malicious ALSA configuration file with sparse bindings to trigger an out-of-bounds array read and assertion failur...
CVE-2026-51996
An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the src/lib/utils.ts and the getServerUrlHash function...
CVE-2026-51995
An issue in geelen mcp-remote 0.1.32 through 0.1.38 allows a remote attacker to obtain sensitive information via the src/lib/authorization-server-metadata.ts, src/lib/utils.ts components...