171504 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-68744
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in SSSD. The sssnssprotocolfillinitgr function in the NSS responder pre-allocates reply space for all group entries but does not shrink the...
CVE-2026-69245
Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, SetCookie::matchesDomain gives every subdomain of a cookie Domain that cookie unless SetCookie::matchesDomain recognizes the Domain as an IP literal or a numeric host, and the decision comes from the domain's own text, so two...
Exploit for CVE-2026-56158
CVE-2026-56158 — .NET Framework Remote Code Execution RCE Po...
JLSEC-2026-1123
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server provides an MQTT client interface. Prior to versions 2.11.15 and 2.12.5, Sessions and Messages can by hijacked via MQTT Client ID malfeasance. Versions 2.11.15 and 2.12.5 patch the issu...
Rapid7 Analysis: KindaRails2Shell (CVE-2026-66066)
Overview On July 29, 2026, the Ruby on Rails project published a security advisory for CVE-2026-66066, an arbitrary file read in Active Storage applications that use the Vips image processor with untrusted uploads. The affected Active Storage ranges are = 8.0, = 8.1, 8.1.3.1. Vips is the default...
Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes
A Cross-Site Scripting XSS vulnerability has been identified in the Angular compiler's internationalization i18n pipeline. Although Angular disallows binding to event-handler attributes such as onclick and onerror through standard attribute validation validateAttribute / validateProperty, the i18...
Zero-Day Remediation Meets Operational Resiliency
Executive Summary In the Frontier AI era, the number of CISA-known exploited vulnerabilities has increased by 6.5x over the past four years, and time-to-exploitation has collapsed to -7 days. Traditional monthly patch cycles cannot keep up. Organizations need a new operating model that detects at...
CVE-2026-18248 @fastify/aws-lambda vulnerable to Lambda event spoofing via client-controlled x-apigateway-event header
@fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and request.awsLambda.context, values that applications are documented to use for authorization decisions such as reading API Gateway authorizer claims. In the default configuration, the getter that...
CVE-2026-18248 @fastify/aws-lambda vulnerable to Lambda event spoofing via client-controlled x-apigateway-event header
@fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and request.awsLambda.context, values that applications are documented to use for authorization decisions such as reading API Gateway authorizer claims. In the default configuration, the getter that...
ROOT-APP-PYPI-CVE-2026-28490 CVE-2026-28490 in Authlib - Patched by Root
Root has patched CVE-2026-28490 in the Authlib package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-GHSA-JJ8C-MMJ3-MMGV GHSA-jj8c-mmj3-mmgv in Authlib - Patched by Root
Root has patched GHSA-jj8c-mmj3-mmgv in the Authlib package for Root:PyPI. Multiple fixed versions available...
JLSEC-2026-1101
libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.1, the uncompressed HEIF decoder validates explicit icef compressed-unit offsets using unitoffset + unitsize. Because the addition can wrap, a crafted HEIF file can pass the range check and then construct a vector...
JLSEC-2026-1095
libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.19.0 through 1.21.2, a crafted HEIF file uncompressed unci codec, tiled, component-interleaved, 4:2:0 triggers a heap out-of-bounds write in libheif's uncompressed tile decoder. The write overwrites the C++ vtable pointer o...
Exploit for CVE-2026-64560
CVE-2026-64560 — Linux Kernel posix-cpu-timers Non-leader exec...
Exploit for CVE-2026-64531
ovswrap-poc CVE-2026-...
ROOT-APP-MAVEN-CVE-2023-20862 CVE-2023-20862 in io.root.org.springframework.security:spring-security-core - Patched by Root
Root has patched CVE-2023-20862 in the io.root.org.springframework.security:spring-security-core package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2024-38827 CVE-2024-38827 in io.root.org.springframework.security:spring-security-core - Patched by Root
Root has patched CVE-2024-38827 in the io.root.org.springframework.security:spring-security-core package for Root:Maven. Multiple fixed versions available...
CVE-2026-69075
FlowIntel is affected by a stored cross-site scripting vulnerability through multiple user-controlled or administrator-controlled fields. Persisted values—including case titles, ticket identifiers, recurring-case information, user profile attributes, organisation names, and role names—were render...
CVE-2026-69075
FlowIntel is affected by a stored cross-site scripting vulnerability through multiple user-controlled or administrator-controlled fields. Persisted values—including case titles, ticket identifiers, recurring-case information, user profile attributes, organisation names, and role names—were render...
CVE-2026-69075
FlowIntel is affected by a stored XSS via multiple stored fields that are rendered within Vue templates. An authenticated user can inject Vue interpolation expressions into fields (case/title/ticket/organization/role/profile, etc.). When other users view affected pages, the application may evalua...