archive-tar-new security vulnerability

archive-tar-new is a Perl module developed by Jos Boumans, used for creating and manipulating tar files in memory. Versions of archive-tar-new prior to version 3.10 contained security vulnerabilities. These vulnerabilities stemmed from the readtar function, which did not set an upper limit when...

Oban Web security vulnerabilities

Oban Web is an embedded real-time backend task monitoring dashboard developed under the Oban Framework. Versions 2.12.0 to 2.12.5 of Oban Web contained a security vulnerability. This vulnerability stemmed from the unlimited cron range expansion in the Elixir.Oban.Web.CronExpr module, which could...

PT-2026-43444

Name of the Vulnerable Software and Affected Versions Yamcs versions prior to 5.12.7 Yamcs versions prior to 5.13.0 Description An LDAP injection occurs in org.yamcs.security.LdapAuthModule during the construction of search filters. The username parameter is inserted directly into the LDAP filter...

NVIDIA Display Driver race condition vulnerability

NVIDIA Display Driver is a graphics driver developed by NVIDIA Corporation. NVIDIA Display Driver has a race condition vulnerability, which arises from user-side reorders in the kernel module that may lead to race conditions through compiler or processor memory instructions, potentially causing...

PT-2026-61314

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ethtool module where the module flash fw schedule function fails to undo the setting of the in progress flag and the acquisition of the netdev reference during...

Important: nginx

Issue Overview: When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting. Note: Software versions which have reached End of Technical Support EoTS are...

Important: nginx

Issue Overview: When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting. Note: Software versions which have reached End of Technical Support EoTS are...

nginx 0.6.27 < 1.30.1 ngx_http_rewrite_module Heap Buffer Overflow

The installed version of nginx is 0.6.27 prior to 1.30.1. It is, therefore, affected by the following issue: - NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttprewritemodule module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set...

SUSE SLES15 Security Update : nginx (SUSE-SU-2026:2050-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2050-1 advisory. This update for nginx fixes the following issues - CVE-2026-27651: denial of service via undisclosed requests when the...

IBM HTTP Server code-related vulnerabilities

IBM HTTP Server is an enterprise-level web server software developed by International Business Machines IBM. Versions 8.5 and 9.0 of IBM HTTP Server contain code vulnerabilities that could lead to denial-of-service attacks due to the optional module modibmUpload...

IBM HTTP Server security vulnerabilities

IBM HTTP Server is an enterprise-level web server software developed by International Business Machines IBM. Versions 8.5 and 9.0 of IBM HTTP Server contain security vulnerabilities; these vulnerabilities stem from the optional module modmemcache, which may lead to denial-of-service attacks...

PT-2026-43408

Name of the Vulnerable Software and Affected Versions oban web versions 2.12.0 through 2.12.4 Description Uncontrolled Resource Consumption in the Elixir.Oban.Web.CronExpr module allows memory exhaustion through unbounded cron range expansion. An attacker with permissions to schedule cron jobs ca...

PT-2026-43161

The GDPR cookies module for Backdrop CMS before 1.x-1.3.5 doesn't sufficiently protect visitors from Cross Site Scripting XSS if a malicious value has been provided for the optional 'Info content' field for the YouTube service. This is mitigated by the fact that an attacker must have a role with...

PT-2026-43438

Name of the Vulnerable Software and Affected Versions Samba affected versions not specified Description A flaw exists in the handling of certificate auto-enrollment Group Policy. When this feature is enabled, Samba may retrieve a CA certificate via an unencrypted HTTP connection and install it in...

CVE-2025-71310: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

The GDPR cookies module for Backdrop CMS before 1.x-1.3.5 doesn't sufficiently protect visitors from Cross Site Scripting XSS if a malicious value has been provided for the optional 'Info content' field for the YouTube service. This is mitigated by the fact that an attacker must have a role with...

PT-2026-61315

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ethtool module where the ethnl ops complete function is not called when validate fails, despite ethnl ops begin having already been executed. This occurs during...

Itsourcecode Student Transcript Processing System SQL Injection Vulnerability

itsourcecode Student Transcript Processing System is an open-source student transcript processing system developed by itsourcecode. Version 1.0 of the itsourcecode Student Transcript Processing System has a SQL injection vulnerability. This vulnerability arises from unknown code in the...

FreeBSD : nginx -- heap buffer overflow in ngx_http_rewrite_module (36a3131d-5600-11f1-b339-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 36a3131d-5600-11f1-b339-3497f65b111b advisory. The nginx developers report: A heap memory buffer overflow might occur in a worker process when using a...

WORM vfs module does not block overwrites

Description The vfsworm module is intended to make files immutable over SMB a short time after they are created. The time window in which they are writable is configurable, defaulting to one hour. The hook that handles renames was checking that the file being renamed was still mutable, but it was...

Check Point Security Gateway security vulnerabilities

Check Point Security Gateway is a series of network security gateway devices developed by the Israeli company Check Point. There is a security vulnerability in Check Point Security Gateway, which arises when the identity-aware module based on browser authentication is enabled, allowing...