CVE-2026-104043

A flaw was found in SSSD. A local attacker with access to the Name Service Switch NSS responder UNIX socket can trigger an integer underflow by sending a specially crafted request with an undersized packet header. This issue causes an out-of-bounds memory read during packet parsing, crashing the...

CVE-2026-104043

A flaw was found in SSSD. A local attacker with access to the Name Service Switch NSS responder UNIX socket can trigger an integer underflow by sending a specially crafted request with an undersized packet header. This issue causes an out-of-bounds memory read during packet parsing, crashing the...

CLEANSTART-2026-NA69133 Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints

Security vulnerability affects the temporal-server package. Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints...

CLEANSTART-2026-NS20833 archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened

Security vulnerability affects the go1.27 package. archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened...

[SECURITY] Fedora 45 Update: ocaml-domain-name-0.5.0-4.fc45

A domain name is a sequence of labels separated by dots, such as foo.example . Each label may contain any bytes. The length of each label may not exceed 63 charactes. The total length of a domain name is limited to 253 byte representation is 255, but other protocols such as SMTP may apply even...

PT-2026-106820

LogicalDOC Enterprise up to and for 9.1.1 is vulnerable to blind SQL injection in the WorkflowsDataServlet component, allowing authenticated user to manipulate SQL queries via crafted workflow template name...

PT-2026-107163

Uncaught Exception CWE-248 in Elastic Endpoint can lead to denial of service via a specially crafted file name. When Elastic Defend's Elastic Endpoint component processes a file name under certain system locale configurations including Chinese, Japanese, and Korean locales on Windows, an unhandle...

EUVD-2025-211038

LogicalDOC Enterprise up to and for 9.1.1 is vulnerable to blind SQL injection in the WorkflowsDataServlet component, allowing authenticated user to manipulate SQL queries via crafted workflow template name...

Linux Distros Unpatched Vulnerability : CVE-2026-104043

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in SSSD. A local attacker with access to the Name Service Switch NSS responder UNIX socket can trigger an integer underflow by sending a...

PT-2026-106297

A flaw was found in SSSD. A local attacker with access to the Name Service Switch NSS responder UNIX socket can trigger an integer underflow by sending a specially crafted request with an undersized packet header. This issue causes an out-of-bounds memory read during packet parsing, crashing the...

PT-2026-107219

Name of the Vulnerable Software and Affected Versions Apache Commons BCEL versions prior to 6.13.0 Description BCEL caches attacker-controlled classes under their self-declared names without validating the requested name. This allows subsequent lookups and name-keyed verification results to refer...

Linux Distros Unpatched Vulnerability : CVE-2026-104041

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in SSSD. An unprivileged local user can repeatedly request lookups for nonexistent entries through the Name Service Switch NSS responder. Becau...

GHSA-G2V6-RQMX-R4W6 @vue/server-renderer: XSS via missing CR in attribute-name blacklist

Description @vue/server-renderer was investigated specifically because it's the one place in Vue where template rendering output becomes a real HTTP response body -- a genuine server-side trust boundary, unlike client-side rendering which only ever affects the same browser session that's already...

@vue/server-renderer: XSS via missing CR in attribute-name blacklist

Description @vue/server-renderer was investigated specifically because it's the one place in Vue where template rendering output becomes a real HTTP response body -- a genuine server-side trust boundary, unlike client-side rendering which only ever affects the same browser session that's already...

GHSA-GXM5-99CW-XJW9 @fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name

Impact @fastify/busboy 3.2.1 and earlier retains a bare carriage return or line feed inside the parsed Content-Disposition parameters returned to the application. The multipart header parser ends a header line only on the two-byte \r\n sequence, so a lone CR or LF embedded in a part header is...

@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name

Impact @fastify/busboy 3.2.1 and earlier retains a bare carriage return or line feed inside the parsed Content-Disposition parameters returned to the application. The multipart header parser ends a header line only on the two-byte \r\n sequence, so a lone CR or LF embedded in a part header is...

CVE-2023-49539

CVE-2023-49539 Book Store Management System v1.0 - Cross-site scripting XSS vulnerability in "index.php/category" - vulnerable field: "Category Name" Description : Book Store Management System v1.0 was discovered to contain a cross-site scripting XSS vulnerability in "/bsmsci/index.php/category"...

CVE-2026-95165

Bacularis 5.4.0 - 6.5.1 is vulnerable to Cross Site Scripting XSS in the Organization name field...

cve-2025-11142-axis-mediaclip-rce

CVE-2025-11142 — OS Command Injection в mediaclip.cgi от AXIS n-day исследовательский отчёт и PoC — пост-патчный технический анализ уязвимости OS command injection с CVSS 7.1 в AXIS VAPIX Media Clip API, независимо переоткрытой и подтверждённой методом black-box тестирования на устройстве Axis. В...

CVE-2023-49986

CVE-2023-49986 School Fees Management System v1.0 - Cross-Site Scripting XSS Vulnerability in "name" parameter on "addnewparent" Description : A cross-site scripting XSS vulnerability in the component “addnewparent” of School Fees Management System 1.0 allow attackers to execute arbitrary web...