15758 matches found
SUSE CVE-2026-92768
A flaw was found in cockpit-machines. This vulnerability allows a local attacker to expose sensitive Virtual Machine VM credentials, including plaintext passwords, by inspecting process command-line arguments during VM creation or installation. The cockpit-machines component passes password value...
SUSE CVE-2026-93566
A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can le...
EUVD-2026-83445
microsandbox: Secret values exposed in world-readable process arguments...
SUSE-SU-2026:23880-1 Security update for glib2
This update for glib2 fixes the following issue: - CVE-2026-15588: GDBusServer pre-authentication DoS via unbounded SASL line buffering bsc1272206...
SUSE-SU-2026:23928-1 Security update for glib2
This update for glib2 fixes the following issue: - CVE-2026-15588: GDBusServer pre-authentication DoS via unbounded SASL line buffering bsc1272206...
PT-2026-97036
Name of the Vulnerable Software and Affected Versions wlc versions prior to 2.0.1 Description The command-line client can send an unscoped API token to an attacker-controlled server when executed within an untrusted repository, pull request checkout, or a directory containing untrusted ancestor...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: gnupg2 (UTSA-2026-054045)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054045 advisory. GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints e.g., use of GPGME ar...
shell-quote: shell-quote: Arbitrary command execution via improper line terminator handling
A flaw was found in shell-quote. This vulnerability allows an attacker to achieve arbitrary command execution by supplying crafted input containing line break characters after a comment marker. When input is quoted, the comment marker comments out subsequent quotes until a newline is encountered,...
UBUNTU-CVE-2026-62866
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then reads the source at the exhausted index without an end-of-input check. ...
io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to control characters in the chunk-size line
A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can le...
io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to control characters in the chunk-size line
A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can le...
CVE-2026-77166
The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items...
CVE-2026-77166
CVE-2026-77166 affects the emoji field in a web application's page emoji update endpoint , where improper input validation allows an authenticated user to inject long text and line breaks , breaking the sidebar layout and potentially hiding other items. The vulnerability is rated CVSS 3.0 2.4 (Lo...
CVE-2026-77166
The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items...
EUVD-2026-83972
The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items...
CVE-2026-77166
The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items...
io.micrometer/micrometer-registry-statsd: io.micrometer/micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing
A flaw was found in Micrometer's StatsD and Logging meter registries. This vulnerability allows a remote attacker to inject line terminators into metric data, such as names or tag values, due to insufficient sanitization of untrusted input. Exploitation can lead to the spoofing of arbitrary...
Django DomainNameValidator Code Execution
The vulnerability of the django.corevalidators.DomainNameValidator module in the Django web application framework is related to improper handling of line separators. Exploiting this vulnerability could allow an attacker to execute arbitrary code...
Linux Distros Unpatched Vulnerability : CVE-2026-93566
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-si...
vm2 Command-Line Interface Code Execution
The vulnerability of the command-line interface of the NPM package manager’s vm2 library is related to initialization errors. Exploiting this vulnerability can allow an attacker to execute arbitrary code...