150401 matches found
AlmaLinux 9.2 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1786121727)
The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1786121727 advisory. - Improper Resource Shutdown or Release vulnerability in Apache Tomcat. If an error occurred including exceeding limits during the...
SUSE CVE-2026-97409
In the Linux kernel, the following vulnerability has been resolved: nvme-fc: Do not cancel requests in io target before it is initialized A new nvme-fc controller in CONNECTING state sees admin request timeout schedules ctrl-ioerrwork to abort inflight requests. This ends up calling...
SUSE CVE-2026-101900
Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class...
SUSE CVE-2026-101908
Axios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOptions but then calls fetch with the original fetchOptions. A separate same-process prototype-pollution flaw populates Object.prototype.headers...
CVE-2026-18145 Fireware OS Stack-based Buffer Overflow in spamd Allows Remote Code Execution
A stack-based buffer overflow vulnerability in the spamBlocker spamd service of WatchGuard Fireware OS allows an authenticated attacker with administrator privileges to crash the service or potentially execute arbitrary code by sending a specially crafted management request...
CVE-2026-18145 Fireware OS Stack-based Buffer Overflow in spamd Allows Remote Code Execution
A stack-based buffer overflow vulnerability in the spamBlocker spamd service of WatchGuard Fireware OS allows an authenticated attacker with administrator privileges to crash the service or potentially execute arbitrary code by sending a specially crafted management request...
CVE-2026-67993
basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f contains a login cross-site request forgery issue in the static credentials callback...
CVE-2026-102877
Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal...
EUVD-2026-89412
Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal...
EUVD-2026-89367
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, a hidden debug interface can be enabled through an authenticated request, allowing additional commands to be sent to a backend service. Once active, this pathway can unintentionally expose system‑level functionality that could be misused if...
Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in fast-uri (CVE-2026-75975, CVE-2026-76172)
Summary Multiple vulnerabilities in the fast-uri URI parsing library CVE-2026-75975, CVE-2026-76172 used by IBM InfoSphere Optim Archive Viewer have been addressed by upgrading the component to version 3.1.5. Vulnerability Details CVEID:CVE-2026-75975 DESCRIPTION: fast-uri is a URI parser for...
CVE-2026-73256
A flaw was found in Mongoose. A remote, unauthenticated attacker can achieve unauthorized access or bypass security controls through HTTP request smuggling. Due to an error in protocol version validation, Mongoose fails to identify HTTP/1.0 requests and incorrectly processes chunked transfer...
CVE-2026-73257
A flaw was found in Mongoose. When processing incoming requests containing both Content-Length and Transfer-Encoding headers, the server accepts both headers instead of rejecting the malformed request. In environments where an upstream proxy processes request boundaries differently, a remote,...
Uncontrolled Resource Consumption
Apache Struts is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to unrestricted reading of JSON request bodies into memory despite the configurable input length limit, which allows an attacker to submit an oversized JSON request and exhaust the application's heap, causi...
CVE-2026-95362
Cross-site request forgery in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-95362
A Cross-site request forgery (CSRF) vulnerability exists in DevTools within Google Chrome prior to version 154.0.8037.57 . A remote attacker could leverage social engineering to bypass the web origin policy using a crafted HTML page. This vulnerability is also present in the chromedriver package ...
EUVD-2026-89255
Cross-site request forgery in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-95362
Cross-site request forgery in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-100286
Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrative user to disclose integration secrets via a crafted API request...