124899 matches found
DEBIAN-CVE-2026-81624
Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certain configuration limits like message buffer sizes and session timeouts cannot be adjusted and default to being unlimited. This allows a...
DEBIAN-CVE-2026-82661
Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list..comment parameters can inject CRLF sequences to create additional headers in generated RFC822...
CVE-2017-11176
This repository does not have a README...
DEBIAN-CVE-2026-82631
A security flaw has been discovered in valkey-io valkey 9.1.0. The affected element is the function handleClientsBlockedOnKey of the file src/blocked.c of the component Blocked-on-keys Subsystem. The manipulation results in use after free. The attack may be performed from remote. A high complexit...
CVE-2026-82628
creationtimestamp| type| source ---|---|--- 2026-08-31 07:30:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3muef4ppacs25 2026-08-31 08:07:16+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mueh76tlu72j...
CVE-2024-34102
Este repositorio no tiene un README...
CVE-2026-82597
creationtimestamp| type| source ---|---|--- 2026-08-31 02:26:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/jdmsvt5spjy6z...
CVE-2026-82556
creationtimestamp| type| source ---|---|--- 2026-08-30 18:34:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3shvhizps2ufc...
CVE-2026-82553
creationtimestamp| type| source ---|---|--- 2026-08-30 18:20:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/jyw662pmparqk 2026-08-31 14:03:31+00:00| seen| https://bsky.app/profile/cvemon.bsky.social/post/3muf347tqbl2x...
CVE-2026-82680
creationtimestamp| type| source ---|---|--- 2026-08-30 16:53:38+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117185499500658483...
ECHO-7E4D-4229-7370
Bulletin has no description...
ECHO-1EC0-58D1-CB3D Keycloak's GHSA advisory (GHSA-gv3v-2cpp-3pmq) lists the affected package/range as org.keycloak:keycloak-quarkus-server < 26.5.6 with no lower bound, so by version string alone 25.0.6 is nominally in range. The actual vulnerable mechanism is the HTTP access log feature (config.HttpAccessLogOptions, HttpAccessLogPropertyMappers) added by the fix commit's PR to mask Authorization/Cookie headers in a verbose access-log pattern. That feature does not exist in 25.0.6 at all — confirmed via a full source search (no HttpAccessLogOptions.java, HttpAccessLogPropertyMappers.java, or any http-access-log config option anywhere in quarkus/config-api or quarkus/runtime). There is no access-log-pattern mechanism in this version capable of the described header disclosure.
Bulletin has no description...
ECHO-7EDB-23C5-02EC
Bulletin has no description...
ECHO-6E54-DE1B-08C9
Bulletin has no description...
ECHO-2AAB-293D-53AF
Bulletin has no description...
ECHO-FEA2-5EA1-2849
Bulletin has no description...
ECHO-1969-C688-A45C Keycloak's GHSA advisory (GHSA-rr5q-3xwr-f323) lists the affected range as < 26.6.3 with no lower bound, so by version string alone 25.0.6 is nominally in range. The actual vulnerability requires a generic parameter-length-limiting mechanism (OIDCProviderConfig's max-length-per-parameter config, TokenEndpoint's checkParameters() gate) that silently drops any oversized request parameter, including subject_token — the fix exempts token-shaped parameters from that drop via a new getTokenParameterNames() method. That length-limiting framework does not exist anywhere in 25.0.6 (same finding as CVE-2026-4634, investigated separately) — confirmed via source search, no getMaxLengthForTheParameter/checkParameters/length-cap mechanism exists on any OIDC grant-type endpoint. With no mechanism to silently drop an oversized subject_token, the described fallback to client-credentials cannot occur.
Bulletin has no description...
ECHO-73AB-600D-62BE Caught by Cursor Bugbot review on PR #19827: the real vulnerability (GHSA-7xf9-4jfc-wgm4) is specific to Fine-Grained Admin Permissions V2's RealmPermissionsV2 treating manage-clients as equivalent to managing the special "admin-permissions" client, which then grants realm-wide admin power. RealmPermissionsV2 and the admin-permissions client concept do not exist in 25.0.6 — its older RealmPermissions.canManageAuthorizationDefault() has no per-ResourceServer parameter at all (it's a single, undifferentiated realm-wide check), so there is no "is this the special admin-permissions client" distinction for a narrow, upstream-faithful fix to attach to. An earlier patch here unconditionally removed MANAGE_CLIENTS from that check to close the described escalation, but that changes intended authorization behavior for every regular client's authorization management, not just a vulnerable path (upstream's real fix leaves the MANAGE_CLIENTS grant intact for non-admin-permissions clients) — reverted.
Bulletin has no description...