CVE-2026-19953

A flaw was found in the URI component for Perl. This vulnerability occurs because the nameprep function, responsible for encoding hostnames, does not properly normalize Unicode characters. As a result, a hostname that is not in a standard Unicode form non-NFC can be encoded into a non-standard...

CVE-2026-26128

CVE-2026-26128 Herramienta en Python para explotar la reflexión de Kerberos mediante la normalización Unicode en Windows Active Directory. Basada en la investigación de Guillaume André / Synacktiv. Instalación Estas herramientas solo son compatibles con Python 3.8+. Clona el repositorio desde...

CVE-2026-2395

CVE-2026-23950 Prueba de concepto para CVE-2026-23950 - Vulnerabilidad de condición de carrera en el paquete tar. Descripción Este repositorio demuestra una vulnerabilidad de condición de carrera en el paquete npm tar versión 7.5.3 que permite la colisión de archivos durante la extracción. La...

CVE-2023-46404

CVE-2023-46404 PCRS es una aplicación web para ejercicios de programación en línea desarrollada en la Universidad de Toronto. Ver repositorio de Bitbucket: https://bitbucket.org/utmandrew/pcrs/src/3.11/ Resumen La página “Questions” de PCRS, con envío de código, y la página “Code editor” son...

CVE-2025-52488

Exploit de Divulgación de Hash NTLM por Normalización de Rutas Unicode en DNN CVE-2025-52488 Resumen Este exploit apunta a una vulnerabilidad en DNN anteriormente DotNetNuke versiones 6.0.0 hasta antes de 10.0.1 que permite a los atacantes divulgar hashes NTLM mediante ataques de normalización de...

AlmaLinux 9.2 [TuxCare] Security Update: python3-setuptools / python3-setuptools-wheel (ALMALINUX9.2:CLSA-2026:1786468462)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1786468462 advisory. - setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList...

CVE-2025-64458-Demo

CVE-2025-64458 — Django Redirect DoS on Windows Description A denial-of-service DoS issue in Django’s redirect responses allows an attacker to trigger excessive CPU work during URL normalization when constructing redirect responses. On Windows, Python’s Unicode NFKC normalization is particularly...

CVE-2026-14978

A flaw was found in go-slug. A local attacker could bypass .terraformignore exclusions, leading to sensitive files being included in Terraform slug uploads. This is caused by improper handling of Unicode normalization during path matching. Mitigation Upgrade to go-slug 0.18.3 or later. Where an...

SUSE-SU-2026:4046-1 Security update for perl-URI

This update for perl-URI fixes the following issue: - CVE-2026-19953: non-NFC host names encoded to non-standard punycode labels due to missing normalization in nameprep bsc1277886...

OESA-2026-3591 perl-URI security update

This module implements the URI class. Objects of this class represent "Uniform Resource Identifier references" as specified in RFC 2396 and updated by RFC 2732. Security Fixes: URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in...

OESA-2026-3590 perl-URI security update

This module implements the URI class. Objects of this class represent "Uniform Resource Identifier references" as specified in RFC 2396 and updated by RFC 2732. Security Fixes: URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in...

OESA-2026-3588 perl-URI security update

This module implements the URI class. Objects of this class represent "Uniform Resource Identifier references" as specified in RFC 2396 and updated by RFC 2732. Security Fixes: URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in...

Security Bulletin: IBM Maximo Application Suite - Predict Component uses multiple dependencies which are vulnerable to multiple CVEs.

Summary BM Maximo Application Suite - Predict Component uses setuptools-80.10.2-py3-none-any.whl Publicly disclosed vulnerability found by Scanner which are vulnerable to CVE-2026-59890. This bulletin contains information addressing the vulnerability. Vulnerability Details CVEID:CVE-2026-59890...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Cloud Pak for Business Automation released in August 2026. Vulnerability Details CVEID:CVE-2026-12590 DESCRIPTION: Impact: In body-parser versions prior to 1.20.6...

CVE-2026-13723

A flaw was found in electron-builder. An attacker can exploit a Unicode Normalization Collision, combined with symlink following behavior, within the zipx.Unzip extraction routine. By crafting a malicious ZIP archive, the attacker can cause the application to treat certain Unicode equivalent...

EUVD-2026-68681

URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep. nameprep lowercases each host label but performs no Unicode normalization. IDNA requires a label to be normalized to Form C before it is encoded RFC 5891, so a label...

PT-2026-83938

Name of the Vulnerable Software and Affected Versions URI for Perl versions prior to 5.36 Description Missing normalization in nameprep causes non-NFC host names to be encoded into non-standard punycode labels. While nameprep lowercases host labels, it fails to perform Unicode normalization to Fo...

PT-2026-89663

URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep. nameprep lowercases each host label but performs no Unicode normalization. IDNA requires a label to be normalized to Form C before it is encoded RFC 5891, so a label...

Unity Linux 20.1070e Security Update: python-setuptools (UTSA-2026-104947)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104947 advisory. setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude,...

SUSE CVE-2026-14978

HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching...