18569 matches found
CVE-2026-56850
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS mTLS client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js 26.x, 24.x, and 22.x...
CVE-2026-17878
An inappropriate implementation flaw was found in the CSS component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=522781838...
CVE-2026-16524
CVE-2026-16524 : A command injection flaw affects PCP’s linux_sockets PMDA. The vulnerability allows injection of shell metacharacters via the metric network.persocket.filter, and, due to failed validation, enables arbitrary command execution as the PMDA user during metrics refresh. The CVSSv3.1 ...
DEBIAN-CVE-2026-17965
Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...
CVE-2026-17761
Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via malicious network traffic. Chromium security severity: Medium...
CVE-2026-64360
A flaw was found in the Linux kernel. The hfsbnoderead function within the HFS/HFS+ filesystem driver could return without fully initializing a buffer. This could lead to the use of uninitialized memory, potentially causing unpredictable system behavior or the disclosure of sensitive information...
CVE-2026-17881
The CVE-2026-17881 entry describes an Integer overflow in WebXR affecting Google Chrome before 151.0.7922.72. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page. Affected component: WebXR in Chrome (Chromium base). Impacted versions are prior to 151.0.7922.7...
CVE-2026-17838
The vulnerability CVE-2026-17838 affects Chrome on iOS prior to 151.0.7922.72, where an incorrect security UI could allow a remote attacker to spoof domains via a crafted HTML page. The issue is documented with a Medium severity (CVSS v3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) and an affected com...
CVE-2026-17755
Incorrect security UI in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. Chromium security severity: Medium...
Low: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: python3.14: python-unversioned-command-3.14.6-2.2.hum1 noarch python3-3.14.6-2.2.hum1 aarch64, x8664 python3-debug-3.14.6-2.2.hum1 aarch64, x8664 python3-devel-3.14.6-2.2.hum1 aarch64, x8664...
CVE-2026-50642
A flaw was found in diff-so-fancy. The application does not properly sanitize non-SGR Select Graphic Rendition terminal control sequences, allowing other control characters and escape sequences to pass through. An attacker can embed malicious control sequences in filenames, diff metadata, or file...
vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion
There is a security flaw in Vim. If you use Vim to open a malicious file written by a hacker, and you use the auto-complete feature while typing, the file can secretly force your computer to run unauthorized commands or malware...
CVE-2026-54574
proot-distro is a utility for managing proot containers. Prior to version 5.1.5, proot-distro install extracted plain tarball root filesystems through extractplaintar in prootdistro/commands/install.py and Docker layers through applylayer in prootdistro/helpers/docker.py without validating...
CVE-2026-18255 Quay: quay: global read-only superuser can view robot account tokens
A flaw was found in Quay. A user configured in GLOBALREADONLYSUPERUSERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account...
io.netty/netty-codec-http2: Netty: Improper header neutralization in netty-codec-http2
A flaw was found in Netty's netty-codec-http2 component. The HTTP/2 encoder does not properly handle special characters in HTTP headers. This vulnerability allows a remote attacker to craft specific HTTP/2 requests, leading to HTTP response splitting and header injection attacks. Such attacks can...
CVE-2026-14270
creationtimestamp| type| source ---|---|--- 2026-07-29 14:38:11+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrs5ntfd6j25 2026-07-29 15:01:00+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrs6wm6hse2d 2026-07-29 15:58:24+00:00| seen|...
CVE-2026-41701
A flaw was found in Spring AMQP. The system generates predictable correlation identifiers IDs for message replies due to an internal simple counter. This predictability could allow an attacker to potentially infer or manipulate message flows, leading to a low impact on the confidentiality and...
CVE-2026-65325
Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate covers the new request hostname. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1....
UBUNTU-CVE-2026-54619
sqlite3 provides Ruby bindings for the SQLite3 embedded database. In version 2.9.4 and earlier, redefining a SQLite function with a different arity frees the previously registered function handler while SQLite may still reference it, resulting in a use-after-free. This issue is fixed in version...