8349 matches found
PT-2026-65737
Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate covers the new request hostname. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1....
PT-2026-65735
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap sock new connection cb l2cap sock new connection cb returned l2cap pisk-chan after release sockparent. Once the parent lock is dropped the newly enqueued child socket sk is reachable...
CVE-2025-67405
CVE-2025-67405 affects Sourcecodester CASAP Automated Enrollment System 1.0. The vulnerability is a SQL Injection in update_password.php via the parameter new_password . This is the root cause, allowing unintended database queries. Documented impact shows low confidentiality, integrity, and avail...
SUSE CVE-2026-64835
FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. Whe...
Security update for apache-commons-lang3, google-guice, maven, maven-resolver, xmvn
This update for apache-commons-lang3, google-guice, maven, maven-resolver, xmvn fixes the following issues: apache-commons-lang3 was updated to 3.20.0: New features: Add SystemProperties.getPathString, Supplier Add JavaVersion.JAVA25 Add JavaVersion.JAVA26 Add SystemUtils.ISJAVA25 Add...
CVE-2026-14038
An insufficient validation of untrusted input flaw was found in the New Tab Page component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=497241148...
PT-2026-65502
Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. From 8.2.1 until 10.1.1, when directConnecttrue is enabled, AppiumCommandExecutor.setDirectConnect reads the directConnectHost, directConnectPort, and directConnectPath fields from...
CVE-2026-66030
Ekushey Project Manager CRM through version 5.0 ccontains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Ticket Title field on the Create New Ticket page. Attackers can craft and...
EUVD-2026-49395
Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Ticket Title field on the Create New Ticket page. Attackers can craft and sto...
SUSE CVE-2026-64325
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon This patch is based on a BUG as reported by Bongani Hlope at https://lore.kernel.org/all/[email protected]/ When a channel-switch...
CVE-2026-64325 wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon This patch is based on a BUG as reported by Bongani Hlope at https://lore.kernel.org/all/[email protected]/ When a channel-switch...
CVE-2026-64325
CVE-2026-64325 is a NULL pointer dereference in the Linux kernel's mt76 Wi-Fi driver , affecting mt7921 and mt7925 chipsets. When a channel-switch announcement (CSA) beacon is received, a queued work item may execute after the station has disconnected, at which point the driver's dev->new_ctx ...
Linux Distros Unpatched Vulnerability : CVE-2026-65902
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DOMPurify before 3.4.7 affected versions = 3.4.5 passes direct references to the module-level DEFAULTALLOWEDTAGS and DEFAULTALLOWEDATTR sets to the...
OESA-2026-3135 jbig2dec security update
jbig2dec is a decoder implementation of the JBIG2 image compression format. Security Fixes: An integer overflow in the jbig2arithiaidctxnew function of Artifex commit cc37d0 allows attackers to cause a Denial of Service DoS via a crafted input.CVE-2026-38076...
OESA-2026-3099 rpm security update
The RPM Package Manager RPM is a powerful package management system capability as below Security Fixes: A heap-based buffer overflow vulnerability was found in RPM's NDB New Database backend in the lib/backend/ndb/rpmpkg.c file. This vulnerability is classified as critical and could affect...
CVE-2026-65902 DOMPurify before 3.4.7 Hook Mutation Pollution via allowedTags
DOMPurify before 3.4.7 affected versions = 3.4.5 passes direct references to the module-level DEFAULTALLOWEDTAGS and DEFAULTALLOWEDATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sanitize is called without an explicit...
exploitarium
Statement This repo was incomplete when published. In regar...
Astra Linux – Vulnerability in Chromium
Insufficient validation of untrusted input in the New Tab Page of Google Chrome prior to version 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Low...
PT-2026-64004
Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1 Description An attacker with valid credentials can cause a denial of service for IMAP by selecting a compression algorithm for the connection that requires excessive memory for its decompression state. By...
