126 matches found
CVE-2026-22045 Traefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall
Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.35 and 3.6.7, there is a potential vulnerability in Traefik ACME TLS certificates' automatic generation: the ACME TLS-ALPN fast path can allow unauthenticated clients to tie up go routines and file descriptors indefinitely when the...
AZL-74636 CVE-2026-0861 affecting package glibc for versions less than 2.35-9
Passing too large an alignment to the memalign suite of functions memalign, posixmemalign, alignedalloc in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption. Note that the attacker must have control over both, the size a...
EUVD-2026-0012
The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.35. This is due to inadequate validation of the resolved URL after following Bitly shortlink redirects in the uploadfunction method...
EUVD-2025-200310
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, Lookyloo passed improperly escaped values to cells rendered in datatables using the orthogonal-data feature. It is definitely exploitable from the popu...
EUVD-2025-199714
Apache Druid’s Kerberos authenticator uses a weak fallback secret...
Apache Druid’s Kerberos authenticator uses a weak fallback secret
Apache Druid’s Kerberos authenticator uses a weak fallback secret when the druid.auth.authenticator.kerberos.cookieSignatureSecret configuration is not explicitly set. In this case, the secret is generated using ThreadLocalRandom, which is not a crypto-graphically secure random number generator...
GHSA-W88F-4875-99C8 Apache Druid’s Kerberos authenticator uses a weak fallback secret
Apache Druid’s Kerberos authenticator uses a weak fallback secret when the druid.auth.authenticator.kerberos.cookieSignatureSecret configuration is not explicitly set. In this case, the secret is generated using ThreadLocalRandom, which is not a crypto-graphically secure random number generator...
CVE-2025-63289
Sogexia Android App Compile Affected SDK v35, Max SDK 32 and fixed in v36, was discovered to contain hardcoded encryption keys in the encryptionhelper.dart file...
EUVD-2025-141296
Malicious code in ira-35 npm...
EUVD-2025-131909
Sogexia Android App Compile Affected SDK v35, Max SDK 32 and fixed in v36, was discovered to contain hardcoded encryption keys in the encryptionhelper.dart file...
Malicious code in kentung-35 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4ef01955e3e78ad3a34e9d32f88751272a44f127ca06440ee833dc0fc86c596 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
CVE-2025-63289
Sogexia Android App Compile Affected SDK v35, Max SDK 32 and fixed in v36, was discovered to contain hardcoded encryption keys in the encryptionhelper.dart file...
CVE-2025-63289
Sogexia Android App Compile Affected SDK v35, Max SDK 32 and fixed in v36, was discovered to contain hardcoded encryption keys in the encryptionhelper.dart file...
CVE-2025-63289
Sogexia Android App Compile Affected SDK v35, Max SDK 32 and fixed in v36, was discovered to contain hardcoded encryption keys in the encryptionhelper.dart file...
PT-2025-46669
Name of the Vulnerable Software and Affected Versions Sogexia Android App versions SDK 35 through SDK 32 Description The Sogexia Android App contains hardcoded encryption keys within the encryption helper.dart file. These keys compromise the confidentiality of data encrypted by the application...
CVE-2025-35041
Airship AI Acropolis allows unlimited MFA attempts for 15 minutes after a user has logged in with valid credentials. A remote attacker with valid credentials could brute-force the 6-digit MFA code. Fixed in 10.2.35, 11.0.21, and 11.1.9...
drm/amd/display: Disable DMCUB timeout for DCN35
...
drm/amd/display: Remove register from DCN35 DMCUB diagnostic collection
...
CVE-2022-50135
Summary (CVE-2022-50135): In the Linux kernel, the RDMA/rxe path contains a bug where, during error handling in rxe_qp_from_init, the qp’s rcq and scq are set to NULL, but later in rxe_qp_do_cleanup they are dereferenced (qp->scq->num_wq and qp->rcq->num_wq). This results in a null-pt...