136271 matches found
K000162758: Linux kernel EROFS driver vulnerability CVE-2026-53015
Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: erofs: unify lcn as u64 for 32-bit platforms As sashiko reported 1, lcn was typed as unsigned long or unsigned int sometimes, which is only 32 bits wide on 32-bit platforms, which causes lcn...
Security Bulletin:Cross-Origin Redirect Headers Vulnerability in urllib3 Prior to 2.7.0
Summary urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connectionfromurl.urlopen..., assertsamehost=False still forward these sensitive headers. This vulnerability is fixed in 2.7.0. Vulnerability...
Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Guardium Key Lifecycle Manager (SKLM/GKLM) (CVE-2026-14529)
Summary WebSphere Application Server is shipped as a component of IBM Guardium Key Lifecycle Manager SKLM/GKLM. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details CVEID:CVE-2026-14529 DESCRIPTION: IBM...
Security Bulletin:IDNA for Python Vulnerability: Resource Consumption and Denial-of-Service Risk with Long Inputs
Summary Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as "\u0660" N or "\u30fb" N + "\u6f22" utilize the validcontexto...
Security Bulletin:UltraJSON Memory Leak Fix in ujson.dump() Prior to 5.12.1
Summary UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump writes to a file-like object and the write operation raises an exception, the serialized JSON string object is not decremented, leaking memory. Each failed write...
Security Bulletin:PyJWT CVE-2023-40254: Local File Inclusion & Server-Side Request Forgery via PyJWKClient uri Argument
Summary PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen which uses Python stdlib's default OpenerDirector registering HTTPHandler, HTTPSHandler, FTPHandler, FileHandler, and DataHandler. There is currently...
Security Bulletin:Catastrophic Backtracking Vulnerability in path-to-regexp with Three or More Parameters
Summary Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period .. For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in [email protected] only prevents ambiguity for two...
Security Bulletin:Mako Template Library Vulnerability: Backslash Traversal on Windows Prior to Version 1.3.12
Summary Mako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using backslash traversal e.g. \..\..\ secret.txt bypasses the directory traversal check in Template.init and the posixpath-based normalization in TemplateLookup.gettemplate, allowing reads of files outside...
Security Bulletin:lxml Local File Access Vulnerability: Fixed in 6.1.0
Summary lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration with resolveentities=True allows untrusted XML input to read local files. Setting the resolveentities option explicitly to...
K000162757: Spring Security vulnerability CVE-2026-47838
Security Advisory Description SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user. Affected...
Security Bulletin:DNS Name Constraints Validation Issue Fixed in cryptography v46.0.6
Summary cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently,...
Security Bulletin:Pallets Click 8.3.2 Command Injection Vulnerability
Summary Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit function, allowing attackers to pass arbitrary OS commands from an unprivileged account. Vulnerability Details CVEID:CVE-2026-7246 DESCRIPTION: Pallets Click, versions 8.3.2 and below,...
K000162755: Node.js CVE-2026-48937
Security Advisory Description A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a GOAWAY frame. This vulnerability affects two supported release lines: Node.js 22 and Node.js 24. CVE-2026-48937 Impact There is no impact; F5 products are not affected b...
Exploit for CVE-2026-52680
CVE-2026-52680 — Apache Kyuubi REST Batch Path-Traversal Arbit...
Security Bulletin: Vulnerabilities in jackson-databind may affect IBM APM Linux KVM Agent for Virtual Environments.
Summary There are vulnerabilities in the jackson-databind jar used by IBM APM Linux KVM Agent for Virtual Environments. Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From...
K000162754: Linux kernel AMD KFD driver vulnerability CVE-2026-53143
Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 The v11 MQD manager incorrectly assigned the CP-compute variants of checkpointmqd/restoremqd for KFDMQDTYPESDMA queues. These...
Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM WebSphere Hybrid Edition, are affected by a server-side request forgery vulnerability (CVE-2026-14529)
Summary IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM WebSphere Hybrid Edition, are affected by a server-side request forgery vulnerability when sipServlet-1.1 is enabled. Vulnerability Details Refer to the security bulletins listed in the...
Security Bulletin: Multiple Vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server and WebSphere Application Server Liberty due to the July 2026 CPU
Summary There are multiple vulnerabilities in the IBM® SDK, Java™ Technology Edition that is shipped with IBM WebSphere Application Server and IBM WebSphere Application Server Liberty. The CVEs listed in this document might affect some configurations of IBM WebSphere Application Server traditiona...