Linux Distros Unpatched Vulnerability : CVE-2026-75931

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit scheme, so a scheme-relative reference...

PT-2026-81395

Name of the Vulnerable Software and Affected Versions Kaltura HTML5 player mwEmbed / html5lib versions 2.x and earlier Description A local file disclosure issue exists due to improper validation of the ServiceUrl parameter in the 'mwEmbedLoader.php' endpoint. This parameter, intended as the base...

Linux Distros Unpatched Vulnerability : CVE-2026-76172

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization...

Interpretation Conflict

Overview fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Interpretation Conflict in resolve through the resolve process in index.js. An attacker can make an application resolve a scheme-relative reference such as //host/ against a...

CVE-2026-17033

An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session. Grafana renders...

CVE-2026-17033 CVE-2026-17033 CVE Record

An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session. Grafana renders...

CVE-2026-17033 CVE-2026-17033 CVE Record

An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session. Grafana renders...

CVE-2026-76172

fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries...

CVE-2026-75931

fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit scheme, so a scheme-relative reference such as a host preceded by two slashes is returned with its host verbatim and no error set. As a result fast-uri's own entry points disagr...

CVE-2026-76172 fast-uri vulnerable to host confusion via percent-encoded scheme normalization

fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries...

CVE-2026-76172 fast-uri vulnerable to host confusion via percent-encoded scheme normalization

fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries...

CVE-2026-76172

fast-uri , a URI parser for Node.js, is vulnerable to host confusion via percent-encoded scheme normalization . The root cause is a legacy decoding pass applied to the scheme component that is never re-escaped before serialization, causing a mismatch between the parsed host (undefined) and the re...

CVE-2026-76172 fast-uri vulnerable to host confusion via percent-encoded scheme normalization

fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries...

CVE-2026-75931

fast-uri , a URI parser for the Node.js ecosystem, is vulnerable to host confusion and policy bypass (CVSS 3.1: 7.5 HIGH ). The root cause is that the host is canonicalized to ASCII form only when the input carries an explicit scheme; scheme-relative references (host preceded by //) are returned ...

CVE-2026-75931 fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references

fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit scheme, so a scheme-relative reference such as a host preceded by two slashes is returned with its host verbatim and no error set. As a result fast-uri's own entry points disagr...

CVE-2026-75931 fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references

fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit scheme, so a scheme-relative reference such as a host preceded by two slashes is returned with its host verbatim and no error set. As a result fast-uri's own entry points disagr...

CVE-2026-75931 fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references

fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit scheme, so a scheme-relative reference such as a host preceded by two slashes is returned with its host verbatim and no error set. As a result fast-uri's own entry points disagr...

PT-2026-80192

Name of the Vulnerable Software and Affected Versions fast-uri versions 2.4.2 through 2.4.4 fast-uri versions 3.1.3 through 3.1.5 fast-uri versions 4.0.1 through 4.1.2 Description fast-uri, a URI parser for Node.js, fails to consistently canonicalize hosts to ASCII form when processing...

PT-2026-80798

Name of the Vulnerable Software and Affected Versions fast-uri versions 2.3.1 through 2.4.4 fast-uri versions 3.0.0 through 3.1.5 fast-uri versions 4.0.0 through 4.1.2 Description During URI parsing, the software performs a legacy decoding pass on the scheme component without re-escaping the...

PT-2026-80879

Name of the Vulnerable Software and Affected Versions Grafana affected versions not specified Description An authenticated attacker with Editor access or alert.instances.external:write permissions can submit an external Alertmanager alert containing a controlled generatorURL. The software renders...