Lucene search
+L

13444 matches found

UbuntuCve
UbuntuCve
added 2026/04/02 6:16 p.m.17 views

CVE-2026-34827

Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack::Multipart::Parserhandlemimehead parses quoted multipart parameters such as Content-Disposition: form-data; name="..." using repeated Stringindex searches combined with...

7.5CVSS5.8AI score0.00475EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2026/04/02 11:40 a.m.3 views

CVE-2026-23414

In the Linux kernel, the following vulnerability has been resolved: tls: Purge asynchold in tlsdecryptasyncwait The asynchold queue pins encrypted input skbs while the AEAD engine references their scatterlist data. Once tlsdecryptasyncwait returns, every AEAD operation has completed and the engin...

5.6AI score0.00244EPSS
SaveExploits0References7Affected Software1
RedHat Linux
RedHat Linux
added 2026/04/02 8:24 a.m.4 views

nodejs: Nodejs network segmentation bypass

A flaw in Node.js's permission model allows Unix Domain Socket UDS connections to bypass network restrictions when --permission is enabled. Even without --allow-net, attacker-controlled inputs such as URLs or socketPath options can connect to arbitrary local sockets via net, tls, or undici/fetch...

10CVSS6.7AI score0.00663EPSS
SaveExploits1References5
Positive Technologies
Positive Technologies
added 2026/04/02 12:0 a.m.8 views

PT-2026-29721

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw related to the handling of asynchronous decryption within the TLS Transport Layer Security protocol. Specifically, the async hold queue, used to manage...

7.5CVSS5.8AI score0.00244EPSS
SaveExploits0
RedhatCVE
RedhatCVE
added 2026/04/01 5:3 p.m.10 views

CVE-2025-14213

Cato Networks’ Socket versions prior to 25 contain a command injection vulnerability that allows an authenticated attacker with access to the Socket web interface UI to execute arbitrary operating system commands as the root user on the Socket’s internal system...

8.3CVSS6.2AI score0.00976EPSS
SaveExploits0References1
RedHat Linux
RedHat Linux
added 2026/04/01 4:46 p.m.5 views

nodejs: Nodejs network segmentation bypass

A flaw in Node.js's permission model allows Unix Domain Socket UDS connections to bypass network restrictions when --permission is enabled. Even without --allow-net, attacker-controlled inputs such as URLs or socketPath options can connect to arbitrary local sockets via net, tls, or undici/fetch...

10CVSS6.7AI score0.00663EPSS
SaveExploits1References5
OSV
OSV
added 2026/04/01 9:22 a.m.14 views

SUSE-SU-2026:20989-1 Security update for kea

This update for kea fixes the following issues: Update to 3.0.3: - CVE-2025-11232: invalid characters cause assert bsc1252863. - CVE-2026-3608: stack overflow via maliciously crafted message bsc1260380. Changelog: A large number of bracket pairs in a JSON payload directed to any endpoint would...

7.5CVSS7.4AI score0.01361EPSS
SaveExploits0References5
OSV
OSV
added 2026/04/01 8:54 a.m.10 views

CLSA-2026-1775033648 postgresql-jdbc: Fix of CVE-2022-21724

CVE-2022-21724: ensure arbitrary classes can't be passed instead of SocketFactory, SSLSocketFactory, CallbackHandler, HostnameVerifier - Restore testing from previous spec versions, exclude broken tests...

9.8CVSS7.2AI score0.0301EPSS
SaveExploits1References1
RedhatCVE
RedhatCVE
added 2026/03/31 10:58 p.m.7 views

CVE-2026-25627

NanoMQ MQTT Broker NanoMQ is an all-around Edge Messaging Platform. Prior to version 0.24.8, NanoMQ’s MQTT-over-WebSocket transport can be crashed by sending an MQTT packet with a deliberately large Remaining Length in the fixed header while providing a much shorter actual payload. The code path...

6.5CVSS5.9AI score0.00472EPSS
SaveExploits1References1
RedhatCVE
RedhatCVE
added 2026/03/31 10:11 p.m.9 views

CVE-2026-21711

A flaw was found in Node.js. The Node.js Permission Model, designed to restrict network access, incorrectly omits permission checks for Unix Domain Socket UDS server operations. This allows local code, even when explicitly denied network access, to create and expose inter-process communication IP...

5.3CVSS6.3AI score0.00146EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/03/31 12:31 p.m.7 views

EUVD-2025-209145

Cato Networks’ Socket versions prior to 25 contain a command injection vulnerability that allows an authenticated attacker with access to the Socket web interface UI to execute arbitrary operating system commands as the root user on the Socket’s internal system...

8.3CVSS6.2AI score0.00976EPSS
SaveExploits0References2
NVD
NVD
added 2026/03/31 12:16 p.m.8 views

CVE-2025-14213

Cato Networks’ Socket versions prior to 25 contain a command injection vulnerability that allows an authenticated attacker with access to the Socket web interface UI to execute arbitrary operating system commands as the root user on the Socket’s internal system...

8.3CVSS0.00976EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/03/31 11:35 a.m.4 views

CVE-2025-14213 Cato's Socket WebUI is vulnerable to OS Command Injection

Cato Networks’ Socket versions prior to 25 contain a command injection vulnerability that allows an authenticated attacker with access to the Socket web interface UI to execute arbitrary operating system commands as the root user on the Socket’s internal system...

8.3CVSS6.2AI score0.00976EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/03/31 11:35 a.m.32 views

CVE-2025-14213 Cato's Socket WebUI is vulnerable to OS Command Injection

Cato Networks’ Socket versions prior to 25 contain a command injection vulnerability that allows an authenticated attacker with access to the Socket web interface UI to execute arbitrary operating system commands as the root user on the Socket’s internal system...

8.3CVSS0.00976EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/03/31 11:35 a.m.5 views

CVE-2025-14213

Cato Networks’ Socket versions prior to 25 contain a command injection vulnerability that allows an authenticated attacker with access to the Socket web interface UI to execute arbitrary operating system commands as the root user on the Socket’s internal system...

8.3CVSS6.2AI score0.00976EPSS
SaveExploits0References2
CVE
CVE
added 2026/03/31 11:35 a.m.17 views

CVE-2025-14213

Cato Networks Socket WebUI (versions prior to 25) is affected by an OS command injection vulnerability. An authenticated attacker with access to the Socket web interface can run arbitrary OS commands as root on the Socket’s internal system. The issue is network-exposed with low attack complexity,...

8.3CVSS6.2AI score0.00976EPSS
SaveExploits0References1
CNNVD
CNNVD
added 2026/03/31 12:0 a.m.14 views

Cato Networks Socket 安全漏洞

Cato Networks Socket is an edge access device from the Israeli company Cato Networks, designed to provide secure network connections and traffic optimization capabilities. Previous versions of Cato Networks Socket 25 contained security vulnerabilities; these vulnerabilities stemmed from command...

8.3CVSS6.1AI score0.00976EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/03/31 12:0 a.m.13 views

PT-2026-29240

Name of the Vulnerable Software and Affected Versions Cato Networks Socket versions prior to 25 Description An authenticated attacker with access to the Socket web interface UI can execute arbitrary operating system commands as the root user on the Socket’s internal system. The issue is a command...

8.3CVSS6.1AI score0.00976EPSS
SaveExploits0References4
NVD
NVD
added 2026/03/30 8:16 p.m.8 views

CVE-2026-21711

A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket UDS server operations without the required permission checks, while all comparable network paths correctly enforce them. As a result, code running under --permission without --allow-net can create and expose local IP...

5.3CVSS0.00146EPSS
SaveExploits0References1
OSV
OSV
added 2026/03/30 8:16 p.m.7 views

UBUNTU-CVE-2026-21711

A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket UDS server operations without the required permission checks, while all comparable network paths correctly enforce them. As a result, code running under --permission without --allow-net can create and expose local IP...

5.3CVSS5.8AI score0.00146EPSS
SaveExploits0References3
Rows per page
Query Builder