Addressable display_uri can show misleading hosts with invalid Punycode A-labels

Impact Addressable::IDNA.tounicode, in the pure-Ruby IDNA implementation, decodes Punycode labels labels beginning with xn-- that are not valid A-labels. Those labels are returned in decoded form, when they should be returned unchanged. That includes: - labels that decode to only ASCII characters...

GHSA-9CRM-G4MF-WC5J Addressable display_uri can show misleading hosts with invalid Punycode A-labels

Impact Addressable::IDNA.tounicode, in the pure-Ruby IDNA implementation, decodes Punycode labels labels beginning with xn-- that are not valid A-labels. Those labels are returned in decoded form, when they should be returned unchanged. That includes: - labels that decode to only ASCII characters...

GHSA-539F-XCGW-2GJG Addressable display_uri can show misleading hosts containing bidi and invisible characters

Impact Addressable::IDNA.tounicode decodes Punycode labels labels beginning with xn-- that contain characters which change how text is displayed without being visible themselves. These include bidirectional controls such as U+202E RIGHT-TO-LEFT OVERRIDE and U+2066–U+2069, zero-width characters, a...

Addressable display_uri can show misleading hosts containing bidi and invisible characters

Impact Addressable::IDNA.tounicode decodes Punycode labels labels beginning with xn-- that contain characters which change how text is displayed without being visible themselves. These include bidirectional controls such as U+202E RIGHT-TO-LEFT OVERRIDE and U+2066–U+2069, zero-width characters, a...

CVE-2026-126349

The Addressable library (versions 2.0.0 through 2.9.1 ) is vulnerable because Addressable::IDNA.to_unicode can decode Punycode labels containing bidirectional controls, zero-width characters, and other default-ignorable format characters. This allows Addressable::URI#display_uri to present a reor...

CVE-2026-126348 Addressable display_uri can show misleading hosts with invalid Punycode A-labels

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 until 2.9.1, the pure-Ruby Addressable::IDNA.tounicode implementation decodes invalid Punycode A-labels instead of returning them unchanged. Labels that decode to ASCII text ...

CVE-2026-126348

The Addressable library (versions 2.0.0 to 2.9.1 ) contains a vulnerability in its pure-Ruby Addressable::IDNA.to_unicode implementation. The flaw allows the library to decode invalid Punycode A-labels instead of returning them unchanged. This can result in Addressable::URI#display_uri showing a ...

DEBIAN-CVE-2026-111062

russh is a Rust SSH client and server library. From version 0.34.0-beta.1 until version 0.64.0, its SSH server does not require the signature algorithm in a public-key authentication signature to match the algorithm named in the authentication request. A client possessing an authorized RSA privat...

CVE-2026-55287

In onCreate of GrantCredentialsPermissionActivity.java, there is a possible way to trick the user into granting account credentials due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed...

CVE-2026-55263

In multiple functions of AllowBindAppWidgetActivity.java, there is a possible misunderstanding of reject/consent actions due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitati...

CVE-2026-55287

In onCreate of GrantCredentialsPermissionActivity.java, there is a possible way to trick the user into granting account credentials due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed...

CVE-2026-55287

In onCreate of GrantCredentialsPermissionActivity.java, there is a possible way to trick the user into granting account credentials due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed...

EUVD-2026-115575

In onCreate of GrantCredentialsPermissionActivity.java, there is a possible way to trick the user into granting account credentials due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed...

CVE-2026-55287

A vulnerability exists in the Google Android component GrantCredentialsPermissionActivity.java within the onCreate method. The root cause is misleading or insufficient UI , which can be leveraged to trick users into granting account credentials. This flaw allows for local escalation of privilege ...

CVE-2026-55263

In multiple functions of AllowBindAppWidgetActivity.java, there is a possible misunderstanding of reject/consent actions due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitati...

CVE-2026-55263

A vulnerability exists in multiple functions of AllowBindAppWidgetActivity.java within the Google Android operating system. The root cause is a misunderstanding of reject or consent actions resulting from misleading or insufficient UI (CWE-451). This flaw can lead to a local escalation of privile...

EUVD-2026-115569

In multiple functions of AllowBindAppWidgetActivity.java, there is a possible misunderstanding of reject/consent actions due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitati...

CVE-2026-55287: Google Android: In onCreate of GrantCredentialsPermissionActivity.java, there is a possible way to trick the user into granting account…

In onCreate of GrantCredentialsPermissionActivity.java, there is a possible way to trick the user into granting account credentials due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed...

PT-2026-135691

In onCreate of GrantCredentialsPermissionActivity.java, there is a possible way to trick the user into granting account credentials due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed...

PT-2026-135685

In multiple functions of AllowBindAppWidgetActivity.java, there is a possible misunderstanding of reject/consent actions due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitati...