CVE-2026-34073

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently, cryptography...

CVE-2026-34073 cryptography has incomplete DNS name constraint enforcement on peer names

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently, cryptography...

CVE-2026-34073

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently, cryptography...

[SECURITY] Fedora 44 Update: bind-9.18.47-1.fc44

BIND Berkeley Internet Name Domain is an implementation of the DNS Domain Name System protocols. BIND includes a DNS server named, which resolves host names to IP addresses; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server ...

DNSdist 安全漏洞

DNSdist is an open-source load balancer designed for highly aware DNS, DoS, and abuse prevention. DNSdist has security vulnerabilities, which allow attackers to inject HTML content into internal web dashboards by sending specially crafted DNS queries to DNSdist instances that are enabled with...

PowerDNS DNSdist 安全漏洞

PowerDNS DNSdist is a proxy software provided by PowerDNS, which offers capabilities for DNS traffic load balancing and security protection. PowerDNS DNSdist has a security vulnerability that stems from excessive memory allocation when processing DNS over QUIC or DNS over HTTP/3 payloads, which m...

PowerDNS DNSdist 安全漏洞

PowerDNS DNSdist is a proxy software provided by PowerDNS, which offers capabilities for DNS traffic load balancing and security protection. PowerDNS DNSdist has a security vulnerability that stems from the use of the DNSQuestion:getEDNSOptions method, where objects are reclaimed and reused,...

Code-Projects Simple Gym Management System SQL注入漏洞

Code-Projects Simple Gym Management System is an open-source gym management system developed by Code-Projects. Version 1.0 of the Code-Projects Simple Gym Management System has a SQL injection vulnerability. This vulnerability arises from incorrect operations on parameters such as...

Discourse 跨站脚本漏洞

Discourse is Discourse open source set of open source community discussion platform. The platform includes features such as community , e-mail and chat rooms . Discourse suffers from a cross-site scripting vulnerability that stems from the user and group display names not being HTML escaped in...

PT-2026-29413

Name of the Vulnerable Software and Affected Versions FastMCP versions prior to 3.2.0 Description FastMCP, a framework for building MCP applications, is susceptible to command injection on Windows systems when server names contain shell metacharacters, such as &. This occurs during the fastmcp...

CVE-2026-34073: Improper Certificate Validation

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently, cryptography...

CVE-2026-34716: Improper Neutralization of Input During Web Page Generation

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo YPTSocket plugin's caller feature renders incoming call notifications using the jQuery Toast Plugin, passing the caller's display name directly as the heading parameter. The toast plugin constructs the heading as...

PT-2026-29427

Name of the Vulnerable Software and Affected Versions: File Browser versions prior to 2.62.2 Description: File Browser versions prior to 2.62.2 are susceptible to Stored Cross-Site Scripting XSS via admin-controlled branding fields. An administrator setting the branding.name field to a malicious...

cryptography 信任管理问题漏洞

cryptography is a Python cryptographic authority open-source library. Versions of cryptography prior to 46.0.6 had a trust management vulnerability. This vulnerability stemmed from DNS name constraints verifying only the SAN within sub-certs, without verifying the peer names presented during each...

WWBN AVideo 跨站脚本漏洞

WWBN AVideo is a video platform building system developed by the WWBN team using PHP. Versions of WWBN AVideo prior to 26.0 contained a cross-site scripting vulnerability. This vulnerability stemmed from the YPTSocket plugin, which directly passed the caller’s display name as an HTML parameter,...

PowerDNS DNSdist 安全漏洞

PowerDNS DNSdist is a proxy software provided by PowerDNS that offers capabilities for DNS traffic load balancing and security protection. PowerDNS DNSdist has a security vulnerability that arises from skipping ACL checks when the earlyacl Drop option is disabled. This vulnerability may cause all...

The vulnerability of the btf_name_valid_section() function in the kernel/bpf/btf.c module, which supports the BPF interpreter of the Linux operating system. This vulnerability allows an attacker to access protected information or cause a service failure.

The vulnerability of the btfnamevalidsection function in the kernel/bpf/btf.c module, which is part of the BPF interpreter support for the Linux operating system, involves reading beyond the buffer’s boundaries. Exploiting this vulnerability could allow an attacker to access protected information...

The vulnerability of the formwrlSSIDget() function (/goform/wifiSSIDget) in the Tenda i12 wireless access point software allows a attacker to execute arbitrary code or cause a service failure.

The vulnerability of the formwrlSSIDget function /goform/wifiSSIDget in the Tenda i12 wireless access point software is caused by a buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to execute arbitrary code or cause service failures...

Linux Distros Unpatched Vulnerability : CVE-2026-34073

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only...

PT-2026-29360

Name of the Vulnerable Software and Affected Versions AVideo versions 26.0 and prior Description The AVideo YPTSocket plugin's caller feature in versions 26.0 and prior renders incoming call notifications using the jQuery Toast Plugin, passing the caller's display name directly as the heading...