125456 matches found
USN-8413-1 cyborg vulnerabilities
It was discovered that Cyborg did not properly enforce project ownership in the Accelerator Request ARQ API. An authenticated user could possibly use this issue to delete ARQs bound to other projects' instances, resulting in a cross-tenant denial of service. CVE-2026-40214 It was discovered that...
CVE-2026-42767 NULL Pointer Dereference in CRMF EncryptedValue Decryption
Issue summary: An attacker-controlled CMP Certificate Management Protocol server could trigger a NULL pointer dereference in a CMP client application. Impact summary: A NULL pointer dereference causes a crash of the application and a Denial of Service. An attacker controlling a CMP server or acti...
CVE-2026-42767
Issue summary: An attacker-controlled CMP Certificate Management Protocol server could trigger a NULL pointer dereference in a CMP client application. Impact summary: A NULL pointer dereference causes a crash of the application and a Denial of Service. An attacker controlling a CMP server or acti...
CVE-2026-42767
The CVE-2026-42767 issue affects the OpenSSL CMP client: processing a CRMF CertRepMessage with EncryptedValue where symmAlg has an OID but no parameters can trigger a NULL pointer dereference, crashing the CMP client and enabling DoS. The vulnerability is due to improper handling during CMP respo...
CVE-2026-42767 NULL Pointer Dereference in CRMF EncryptedValue Decryption
Issue summary: An attacker-controlled CMP Certificate Management Protocol server could trigger a NULL pointer dereference in a CMP client application. Impact summary: A NULL pointer dereference causes a crash of the application and a Denial of Service. An attacker controlling a CMP server or acti...
CVE-2026-35188 Double-free When Checking OCSP Stapled Response
Issue summary: A malicious server can exploit TLS OCSP stapling by delivering a crafted response through the statusrequest extension, triggering a double-free in the client's certificate verification path. Impact summary: Successful exploitation allows an attacker to corrupt heap memory via a...
CVE-2026-49842 FreeSWITCH: Pre-authentication bandwidth amplification via `mod_verto` speed-test frames
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, modverto's WebSocket frame loop intercepts a -prefixed speed-test protocol SPU / SPB / SP...
CVE-2026-49841 FreeSWITCH: Pre-authentication heap buffer overflow in `mod_verto` HTTP POST body read
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, the modverto HTTP request handler allocates a fixed 2 MiB buffer for a POST...
CVE-2026-49841
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, the modverto HTTP request handler allocates a fixed 2 MiB buffer for a POST...
EUVD-2026-35472
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, the modverto HTTP request handler allocates a fixed 2 MiB buffer for a POST...
MAL-2026-5396 Malicious code in @sqlite-node/createsql (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f6f2c4e3192b71fc68681fbb8c8216a5e581e9f2baaa13954172249a8ddf5b6 The package advertises itself as a SQLite toolkit but ships no SQLite functionality. Its main entry index.js is a single heavily obfuscated module...
Security update for libsoup
This update for libsoup fixes the following issues CVE-2026-1801: HTTP Request Smuggling in soupfilterinputstreamreadline bsc1257649. CVE-2026-4271: use-after-free in the HTTP/2 server when user signal handlers disconnect connections during callback execution bsc1259767. Patch Instructions: To...
SUSE-SU-2026:2314-1 Security update for libsoup
This update for libsoup fixes the following issues - CVE-2026-1801: HTTP Request Smuggling in soupfilterinputstreamreadline bsc1257649. - CVE-2026-4271: use-after-free in the HTTP/2 server when user signal handlers disconnect connections during callback execution bsc1259767...
CVE-2026-11491
A vulnerability was identified in CodeAstro Human Resource Management System 1.0. Impacted is an unknown function of the file /notice/Allnotice of the component Notice Board Management. Such manipulation of the argument Notice Title with the input as part of POST leads to cross site scripting. It...
Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb setmap request via mapwidths indexing
...
CVE-2026-45416 vulnerabilities
Vulnerabilities for packages: infinispan, pinot, s3proxy, opensearch-fips, solr, sonarqube, seata, kafka-bridge, knative-kafka-broker, cassandra, kserve-modelmesh, pinot-fips, kafbat-ui, spark-kubernetes-operator, airbyte-server-fips, druid, wavefront-proxy, wazuh-indexer, zipkin, keycloak-fips,...
GHSA-X4GW-5CX5-PGMH vulnerabilities
Vulnerabilities for packages: infinispan, pinot, s3proxy, opensearch-fips, solr, sonarqube, seata, kafka-bridge, knative-kafka-broker, cassandra, kserve-modelmesh, pinot-fips, kafbat-ui, spark-kubernetes-operator, airbyte-server-fips, druid, wavefront-proxy, wazuh-indexer, zipkin, keycloak-fips,...
CVE-2026-44249 vulnerabilities
Vulnerabilities for packages: infinispan, pinot, s3proxy, opensearch-fips, solr, sonarqube, seata, kafka-bridge, knative-kafka-broker, cassandra, kserve-modelmesh, pinot-fips, kafbat-ui, spark-kubernetes-operator, airbyte-server-fips, druid, wavefront-proxy, wazuh-indexer, zipkin, keycloak-fips,...
GHSA-3QP7-7MW8-WX86 vulnerabilities
Vulnerabilities for packages: infinispan, pinot, s3proxy, opensearch-fips, solr, sonarqube, seata, kafka-bridge, knative-kafka-broker, cassandra, kserve-modelmesh, pinot-fips, kafbat-ui, spark-kubernetes-operator, airbyte-server-fips, druid, wavefront-proxy, wazuh-indexer, zipkin, keycloak-fips,...
CVE-2026-41853
Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48...