23735 matches found
CVE-2026-64785
SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting. This vulnerability is addressed in swift-nio-http2...
CVE-2026-47743
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored XSS. First, several Livewire components in the admin panel exposed Eloquent model identifiers as public properties without...
CVE-2026-47743 Shopper: Multiple data integrity and disclosure issues in admin Livewire components
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored XSS. First, several Livewire components in the admin panel exposed Eloquent model identifiers as public properties without...
CVE-2026-47743
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored XSS. First, several Livewire components in the admin panel exposed Eloquent model identifiers as public properties without...
SUSE-SU-2026:22938-1 Security update for runc
This update for runc fixes the following issues: Update to 1.3.6. - CVE-2026-41579: malicious image with a /dev symlink can trigger limited host filesystem integrity violations bsc1268275. Other updates and bugfixes: - Version 1.3.6: Various integration test improvements. When masking directories...
UBUNTU-CVE-2026-15037
Improper output neutralization XML injection in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under th...
CVE-2026-15037
Improper output neutralization XML injection in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under th...
PYSEC-2026-3538 Prompty: Arbitrary file read via file reference expansion
Summary Prompty loaders expanded $file:... references in .prompty frontmatter without enforcing that the resolved path stayed within an authorized directory. An attacker-controlled prompt file could use path traversal or an absolute path to cause the host application to read files accessible to t...
Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records
...
OPENSUSE-SU-2026:11345-1 amazon-ecs-init-1.105.0-2.1 on GA media
These are all security issues fixed in the amazon-ecs-init-1.105.0-2.1 package on the GA media of openSUSE Tumbleweed...
Important: libpq security update
The libpq package provides the PostgreSQL client library, which allows client programs to connect to PostgreSQL servers. Security Fixes: postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory CVE-2026-6477 For more details about the security issues,...
SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:3166-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3166-1 advisory. The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues The following security issu...
n8n: GraphQL Node Bypasses "Allowed HTTP Request Domains" Restriction
Impact The GraphQL node did not enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials such as Header Auth, Basic Auth, Query Auth, and OAuth, unlike the HTTP Request node. An authenticated user able to create or edit workflows could therefore point the node's endpoint a...
EUVD-2026-42609
n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector...
EUVD-2026-47579
Netty XML: Injection / Risky Sink — unconfigured XML factory with active DTD and entity handling...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: hugo: hugo-0.164.0-0.1.2.hum1 aarch64, x8664 hugo-0.164.0-0.1.2.hum1.src src Security Fixes: hugo: CVE-2026-56852...
Low: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: libarchive: bsdcat-3.8.8-3.1.hum1 aarch64, x8664 bsdcpio-3.8.8-3.1.hum1 aarch64, x8664 bsdtar-3.8.8-3.1.hum1 aarch64, x8664 bsdunzip-3.8.8-3.1.hum1 aarch64, x8664 libarchive-3.8.8-3.1.hum1 aarch6...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: opentofu1.11: opentofu1.11-1.11.13-0.2.hum1 aarch64, x8664 opentofu1.11-1.11.13-0.2.hum1.src src Security Fixes: opentofu1.11: CVE-2026-56852...
Security update for python-sqlparse
This update for python-sqlparse fixes the following issue Fixed a bug where formatting list of tuples leads to denial of service bsc1268597. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you ca...
