985977 matches found
CVE-2026-42218
CVE-2026-42218 affects xrdp, an open source RDP server. The issue is a timing side‑channel in the login interface of versions 0.10.6 and earlier that allows remote observers to infer whether a username exists, enabling information disclosure via username enumeration. The vulnerability is explicit...
CVE-2026-63429 HeyForm has unauthenticated /api/upload endpoint that accepts arbitrary files with no auth/session/form context
HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, POST /api/upload has no authentication guard, no global guard, no form-context validation, no openToken requirement, and no session cookie check. Any anonymous internet user can upload files PDF, DOC/DOCX, XLS/XLSX, CSV, TXT, MP...
EUVD-2026-45985
HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, completeSubmission accepts a hiddenFields: id, name, value array from the submitter and stores it verbatim in submission.hiddenFields, without validating the supplied id/name against the form's declared form.hiddenFields schema...
CVE-2026-53394
A flaw was found in the Linux kernel's Network File System NFS version 4.0 NFSv4.0 OPEN implementation. A race condition can occur when two NFSv4.0 OPEN threads with the same owner string attempt to open a file, and a concurrent thread inserts a new unconfirmed owner. This can lead to a memory le...
Security update for python311
This update for python311 fixes the following issues CVE-2026-1502: CR/LF bytes not rejected by HTTP client proxy tunnel headers or host bsc1261969. CVE-2026-4786: URLs containing %action can bypass mitigation that allows command injection via the webbrowser.open API bsc1262319. CVE-2026-6019: HT...
SUSE-SU-2026:3132-1 Security update for python311
This update for python311 fixes the following issues - CVE-2026-1502: CR/LF bytes not rejected by HTTP client proxy tunnel headers or host bsc1261969. - CVE-2026-4786: URLs containing %action can bypass mitigation that allows command injection via the webbrowser.open API bsc1262319. -...
Important: Red Hat Security Advisory: Red Hat Web Terminal Operator 1.12.1 release.
Red Hat Web Terminal Operator 1.12.1 has been released. The Web Terminal provides a way to access a fully in-browser terminal emulator within the OpenShift Console. Command-line tools for interacting with the OpenShift cluster are pre-installed...
Important: Red Hat Security Advisory: Red Hat Web Terminal Operator 1.11.1 release.
Red Hat Web Terminal Operator 1.11.1 has been released. The Web Terminal provides a way to access a fully in-browser terminal emulator within the OpenShift Console. Command-line tools for interacting with the OpenShift cluster are pre-installed...
opentelemetry-java: opentelemetry-api: opentelemetry-extension-trace-propagators: OpenTelemetry Java: Denial of Service due to unbounded memory allocation when parsing oversized baggage
A flaw was found in OpenTelemetry Java, specifically within the baggage propagation implementation of opentelemetry-api and opentelemetry-extension-trace-propagators. A remote attacker can exploit this vulnerability by sending oversized baggage, which leads to unbounded memory allocation and high...
Important: Red Hat Security Advisory: Red Hat Developer Hub 1.9.7 release.
Red Hat Developer Hub 1.9.7 has been released. Red Hat Developer Hub RHDH is Red Hat's enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters AKS, EKS, GKE. The core features of RHDH include a single...
apparmor: mediate the implicit connect of TCP fast open sendmsg
...
PT-2026-61691
cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary URLs by crafting malicious state parameters. Attackers can exploit the unsigned state parameter and onErrorReturnTo field to silently...
Nebula AI-Powered Penetration Testing 2.0.1b2
Nebula is an advanced, AI-powered penetration testing open-source tool that revolutionizes penetration testing by integrating state-of-the-art AI models into your command-line interface. Designed for cybersecurity professionals, ethical hackers, and developers, Nebula automates vulnerability...
PT-2026-61685
The Joomla extension Hikashop is vulnerable to an open redirect...
The vulnerability of software platforms for developing and managing online stores like Magento Open Source, Adobe Commerce, and Adobe Commerce B2B lies in the redirection of URLs to unreliable websites, allowing attackers to circumvent security restrictions.
The vulnerability of software platforms for developing and managing online stores like Magento Open Source, Adobe Commerce, and Adobe Commerce B2B relates to the redirection of URLs to unreliable websites. Exploiting this vulnerability can allow attackers to bypass security restrictions remotely...
The vulnerability of software platforms for developing and managing online stores like Magento Open Source, Adobe Commerce, and Adobe Commerce B2B lies in their lack of authentication mechanisms, which allow attackers to circumvent security restrictions.
The vulnerabilities of the software platforms for developing and managing online stores such as Magento Open Source, Adobe Commerce, and Adobe Commerce B2B are related to deficiencies in authentication mechanisms. Exploiting these vulnerabilities can allow attackers to bypass security restriction...
The vulnerability of software platforms for developing and managing online stores such as Magento Open Source, Adobe Commerce, and Adobe Commerce B2B lies in the insufficient protection of sensitive data. This allows attackers to circumvent security restrictions.
The vulnerability of software platforms for developing and managing online stores like Magento Open Source, Adobe Commerce, and Adobe Commerce B2B is related to insufficient protection of sensitive data. Exploiting this vulnerability can allow a malicious actor to bypass security restrictions...
Amazon Linux 2023 : compat-golang-github-cpuguy83-md2man-2-devel, golang-github-cpuguy83-md2man, golang-github-cpuguy83-md2man-devel (ALAS2023-2026-1989)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1989 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /...
The vulnerability of software platforms for developing and managing online stores such as Magento Open Source, Adobe Commerce, and Adobe Commerce B2B lies in the lack of protective measures for website structures, allowing attackers to execute arbitrary code.
The vulnerabilities of the software platforms for developing and managing online stores such as Magento Open Source, Adobe Commerce, and Adobe Commerce B2B are related to the lack of measures taken to protect the website structure. Exploiting these vulnerabilities allows a malicious actor to...
The vulnerability of software platforms for developing and managing online stores like Magento Open Source, Adobe Commerce, and Adobe Commerce B2B lies in their lack of authentication mechanisms, which allow attackers to circumvent security restrictions.
The vulnerabilities of the software platforms for developing and managing online stores such as Magento Open Source, Adobe Commerce, and Adobe Commerce B2B are related to deficiencies in authentication mechanisms. Exploiting these vulnerabilities can allow attackers to bypass security restriction...