65106 matches found
Important: nginx
Issue Overview: A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a...
The vulnerability of the http_proxy_connect() function in the RDP client FreeRDP allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the httpproxyconnect function in the RDP client FreeRDP is related to the lack of handling for CRLF sequences in HTTP headers when processing the variable ServerHostname. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and...
Amazon Linux 2023 : nginx, nginx-all-modules, nginx-core (ALAS2023-2026-2008)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2008 advisory. A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the...
FreeBSD : Angie -- multiple vulnerabilities (347fe124-8f53-11f1-9f4f-3c7c3fba4204)
"The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 347fe124-8f53-11f1-9f4f-3c7c3fba4204 advisory. The Angie Software Team reports: When evaluating a string expression in which unnamed capture...
Exploit for Use of Uninitialized Variable in Google Chrome
--- CVE-2026-11104 – Python SSTI via Jinja2 |attr Filter B...
SUSE CVE-2026-17347
The MASTERPASSWORDHOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with %u in the configured string replaced by the current user's name. The previous implementation substituted the username directly into the...
Exploit for Use of Uninitialized Variable in Google Chrome
CVE-2026-11101 – HTTP Cache Poisoning via Unkeyed Query Parame...
SUSE CVE-2026-67322
GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clonefrom. The caller-supplied remote URL is passed through Git.polishurl, which on non-Cygwin platforms calls os.path.expandvars on the URL before invoking git clone. An attacker who controls the clone URL can emb...
Use After Free
Overview Affected versions of this package are vulnerable to Use After Free in the C HTTP response parser error handling. An attacker can cause the application to crash or become unresponsive by sending a specially crafted malformed chunked response. Workaround This vulnerability can be mitigated...
CVE-2026-47211
Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. In versions prior to 0.39.0, if a user clones a malicious repository and runs Ouroboros commands within that directory, it can lead to arbitrary code executi...
CVE-2026-47211 Ouroboros: Remote Code Execution via Untrusted Project-Directory .env
Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. In versions prior to 0.39.0, if a user clones a malicious repository and runs Ouroboros commands within that directory, it can lead to arbitrary code executi...
CVE-2026-47211
CVE-2026-47211 affects Ouroboros (local-first runtime for AI coding agents). Prior to version 0.39.0, loading the project-local .env could cause arbitrary code execution when a user runs Ouroboros commands in a cloned malicious repository; execution-affecting variables like OUROBOROS_CLI_PATH and...
CVE-2026-47211
Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. In versions prior to 0.39.0, if a user clones a malicious repository and runs Ouroboros commands within that directory, it can lead to arbitrary code executi...
CVE-2026-47211 Ouroboros: Remote Code Execution via Untrusted Project-Directory .env
Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. In versions prior to 0.39.0, if a user clones a malicious repository and runs Ouroboros commands within that directory, it can lead to arbitrary code executi...
CVE-2026-47211 Ouroboros: Remote Code Execution via Untrusted Project-Directory .env
Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. In versions prior to 0.39.0, if a user clones a malicious repository and runs Ouroboros commands within that directory, it can lead to arbitrary code executi...
EUVD-2026-52425
Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. In versions prior to 0.39.0, if a user clones a malicious repository and runs Ouroboros commands within that directory, it can lead to arbitrary code executi...
CVE-2026-67322
A flaw was found in GitPython. A remote attacker can exploit a vulnerability in the Repo.clonefrom method by providing a specially crafted Git repository URL. This URL can contain references to environment variables, which are then expanded and included in the URL. This allows the attacker to...
Rapid7 Analysis: KindaRails2Shell (CVE-2026-66066)
Overview On July 29, 2026, the Ruby on Rails project published a security advisory for CVE-2026-66066, an arbitrary file read in Active Storage applications that use the Vips image processor with untrusted uploads. The affected Active Storage ranges are = 8.0, = 8.1, 8.1.3.1. Vips is the default...