net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

Exploit for CVE-2026-44351

CVE-2026-44351 — Falsificación de JWT por Secret Vacío en fas...

Chromium CVE-2026-87618: Incorrect reference resolution in Storage

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium CVE-2026-87613: Incorrect reference resolution in Extensions

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium CVE-2026-87562: Incorrect reference resolution in Accessibility

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium CVE-2026-87547: Incorrect reference resolution in FileSystem

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

FreeBSD : git-lfs -- Improper Link Resolution Before File Access (107f9dad-b05c-11f1-9369-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 107f9dad-b05c-11f1-9369-b42e991fc52e advisory. https://github.com/git-lfs/git-lfs/security/advisories/GHSA-6pvw-g552-53c5 reports: Git LFS is a Git...

PT-2026-93145

Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a local attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a local program. Chromium security severity: High...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

rsync: rsync: Unauthorized File Access via Symlink Module Root

A flaw was found in rsync. This path traversal vulnerability allows remote clients to access files outside the intended module root. This occurs when the use chroot option is disabled and the module root path, or a component of it, is a symbolic link. The rsync daemon fails to resolve symlinks...

rsync: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure

A flaw was found in rsync. This vulnerability allows a remote attacker to bypass hostname-based access control rules. By inducing DNS resolution failures, the rsync daemon incorrectly skips deny rules, granting unauthorized access to restricted module file trees...

CVE-2026-53708 ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)

ContextForge is an AI gateway, registry, and proxy that provides centralized discovery, guardrails, and management for MCP, A2A, and REST or gRPC APIs. Prior to 1.0.3, the /admin/gateways/test call site in mcpgateway/admin.py calls validategatewaytesturl in mcpgateway/common/validators.py to...

CVE-2026-57126

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, SpiderTools.validateurl calls hostisblocked, which checks literal host encodings but does not resolve DNS names before scrapepage, crawl, extractlinks, extracttext, or URL-mention fetches connect. An attacker-controlled...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

CVE-2026-57126

PraisonAI 's multi-agent system (packages praisonaiagents ≤ 1.6.39 / PraisonAI ≤ 4.6.39) is affected by a CWE-918 SSRF in SpiderTools._validate_url (praisonaiagents/tools/spider_tools.py). The guard (_host_is_blocked) checks only literal IP encodings and never resolves DNS names , so an attacker-...

EUVD-2026-77542

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, SpiderTools.validateurl calls hostisblocked, which checks literal host encodings but does not resolve DNS names before scrapepage, crawl, extractlinks, extracttext, or URL-mention fetches connect. An attacker-controlled...

CVE-2026-57126 praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, SpiderTools.validateurl calls hostisblocked, which checks literal host encodings but does not resolve DNS names before scrapepage, crawl, extractlinks, extracttext, or URL-mention fetches connect. An attacker-controlled...