4896 matches found
PT-2026-62189
Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1 Oracle GraalVM for JDK versions 17.0.19, 21.0.11 Oracle GraalVM Enterprise Edition version 21.3.18 Description An unauthenticated attacker with network access...
PT-2026-62982
Name of the Vulnerable Software and Affected Versions MySQL Server versions 8.4.0 through 8.4.10 MySQL Server versions 9.7.0 through 9.7.1 MySQL Cluster versions 8.0.0 through 8.0.47 MySQL Cluster versions 8.4.0 through 8.4.10 MySQL Cluster versions 9.7.0 through 9.7.1 Description A flaw exists i...
PT-2026-62186
Name of the Vulnerable Software and Affected Versions MySQL Server versions 8.4.0 through 8.4.10 MySQL Server versions 9.7.0 through 9.7.1 MySQL Cluster versions 8.0.0 through 8.0.47 MySQL Cluster versions 8.4.0 through 8.4.10 MySQL Cluster versions 9.7.0 through 9.7.1 Description An issue exists...
PT-2026-62218
Name of the Vulnerable Software and Affected Versions Oracle Java SE version 8u491 Oracle Java SE version 8u491-perf Oracle Java SE versions prior to 11.0.32 Description A flaw in the Scripting component allows an unauthenticated attacker with network access via multiple protocols to compromise t...
GHSA-QFRW-5RXM-MHH2 Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution
Summary Type: URL-scheme allowlist gap. The safeurl filter only blocks the four schemes javascript:, vbscript:, file:, data:. Several other schemes are accepted into rendered and tags despite being known XSS vectors in legacy or chain-handling browsers. The same gap applies to direct links,...
EUVD-2026-45617
In the Linux kernel, the following vulnerability has been resolved: ovpn: respect peer refcount in CMDNEWPEER error path ovpnnlpeernewdoit's error path calls ovpnpeerrelease directly rather than ovpnpeerput, bypassing the kref. The accompanying comment "peer was not yet hashed, thus it is not use...
CVE-2026-62234 Grav < 2.0.4 SSRF via Unrestricted cURL Protocols
Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.write permission to create webhooks with file://, dict://, or gopher:// URLs. Attackers can trigger webhook events to read local files, access process information, or pivot to...
CVE-2026-62234 Grav < 2.0.4 SSRF via Unrestricted cURL Protocols
Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.write permission to create webhooks with file://, dict://, or gopher:// URLs. Attackers can trigger webhook events to read local files, access process information, or pivot to...
EUVD-2026-45080
Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.write permission to create webhooks with file://, dict://, or gopher:// URLs. Attackers can trigger webhook events to read local files, access process information, or pivot to...
CVE-2026-62234
Grav 2.x prior to 2.0.4 contains an SSRF vulnerability in webhook dispatch where authenticated users with api.webhooks.write can create webhooks using file://, dict://, or gopher:// protocols. This unrestricted protocol handling can be leveraged to read local files, access process information, or...
PT-2026-60644
Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.4 Description Authenticated users with api.webhooks.write permission can create webhooks using unrestricted cURL protocols such as file://, dict://, or gopher://. This allows attackers to trigger webhook events to re...
CVE-2026-56454
HCL DFXAnalytics is affected by a Deprecated Protocol vulnerability due to the use of TLS 1.0 and TLS 1.1. These legacy protocols contain numerous cryptographic design flaws that expose data to interception and decryption. To remediate this risk, the application must disable all support for TLS 1...
CVE-2026-56454
CVE-2026-56454 affects HCL DFXAnalytics. The vulnerability stems from the use of deprecated TLS protocols (TLS 1.0/1.1), which have cryptographic weaknesses that can expose data to interception and decryption. The available documents report a base CVSS v3.1 score of 7.5 (HIGH) from NVD, with netw...
EUVD-2026-44922
HCL DFXAnalytics is affected by a Deprecated Protocol vulnerability due to the use of TLS 1.0 and TLS 1.1. These legacy protocols contain numerous cryptographic design flaws that expose data to interception and decryption. To remediate this risk, the application must disable all support for TLS 1...
USN-8545-1: Linux kernel (HWE) vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - Block layer subsystem; - Cryptographic API; - DMA engine subsystem; - InfiniBand drivers; -...
OPENSUSE-SU-2026:21339-1 Security update for python-mistune
This update for python-mistune fixes the following issues - CVE-2026-59922: quadratic-time parsing on long runs of some markers in formatting.py can lead to DoS bsc1271117. - CVE-2026-59923: HTMLRenderer.safeurl does not block percent-encoded javascript URIs and allows for XSS bsc1271119. -...
SUSE-SU-2026:22655-1 Security update for python-mistune
This update for python-mistune fixes the following issues - CVE-2026-59922: quadratic-time parsing on long runs of some markers in formatting.py can lead to DoS bsc1271117. - CVE-2026-59923: HTMLRenderer.safeurl does not block percent-encoded javascript URIs and allows for XSS bsc1271119. -...
[SECURITY] Fedora 44 Update: python-dulwich-1.2.9-1.fc44
Dulwich is a Python implementation of the Git file formats and protocols. The project is named after the village in which Mr. and Mrs. Git live in the Monty Python sketch...
DEBIAN-CVE-2026-57216
RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, AMQP 0-9-1, AMQP 1.0, and Stream Protocol authentication can allow a loopback-restricted user such as guest to connect remotely when traffic is accepted through a trusted PROXY-protocol path and the backend...