GHSA-M675-2P33-XV9G Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files

Summary The FastCGI transport's splitPos in modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead Caddy's FastCGI splitting into treatin...

Improper Handling of Case Sensitivity

Overview Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity via the splitPos function. An attacker can execute arbitrary code by uploading a file with a specially crafted Unicode filename and accessing it through a crafted URL, causing the FastCGI handler to...

Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files

Summary The FastCGI transport's splitPos in modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead Caddy's FastCGI splitting into treatin...

md4c:fuzz-mdhtml: Heap-buffer-overflow in md_decode_utf8__

Project: https://github.com/mity/md4c.git Detailed Report: https://oss-fuzz.com/testcase?key=5856922799767552 Project: md4c Fuzzing Engine: libFuzzer Fuzz Target: fuzz-mdhtml Job Type: libfuzzerasanmd4c Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x7841f0a04bcf Crash...

[SECURITY] Fedora 42 Update: uriparser-1.0.1-1.fc42

Uriparser is a strictly RFC 3986 compliant URI parsing library written in C. uriparser is cross-platform, fast, supports Unicode and is licensed under the New BSD license...

Improper Handling of Case Sensitivity

Overview Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity through improper handling of Unicode characters in the splitPos function. An attacker can execute arbitrary code by uploading a file with a specially crafted name containing non-ASCII bytes or Unico...

FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files

Summary The splitPos function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead FrankenPHP into treating a non-.php file as a .php script. In any deployment where the...

Fedora 44 : perl-Net-CIDR-Lite (2026-6f3d2d0d82)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6f3d2d0d82 advisory. This update addresses some input validation issues: Reject Unicode digits and trailing newlines in parser inputs CVE-2026-45190 Reject zero-padded...

TencentOS Server 4: glib2 (TSSA-2026:0277)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0277 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

CVE-2026-44288

protobufjs compiles protobuf definitions into JavaScript JS functions. Prior to 7.5.6 and 8.0.2, protobufjs includes a minimal UTF-8 decoder that accepted overlong UTF-8 byte sequences and decoded them to their canonical characters instead of replacing them. An attacker who can provide protobuf...

CVE-2026-44288 protobufjs: Overlong UTF-8 decoding

protobufjs compiles protobuf definitions into JavaScript JS functions. Prior to 7.5.6 and 8.0.2, protobufjs includes a minimal UTF-8 decoder that accepted overlong UTF-8 byte sequences and decoded them to their canonical characters instead of replacing them. An attacker who can provide protobuf...

CVE-2026-44288 protobufjs: Overlong UTF-8 decoding

protobufjs compiles protobuf definitions into JavaScript JS functions. Prior to 7.5.6 and 8.0.2, protobufjs includes a minimal UTF-8 decoder that accepted overlong UTF-8 byte sequences and decoded them to their canonical characters instead of replacing them. An attacker who can provide protobuf...

CVE-2020-37221

Atomic Alarm Clock 6.3 is affected by a local, stack-overflow vulnerability in the Time Zones Clock configuration display name field. The issue arises from a crafted string causing a SEH overwrite with encoded shellcode, potentially bypassing SafeSEH protections and leading to arbitrary code exec...

CVE-2020-37221 Atomic Alarm Clock 6.3 Stack Overflow via SEH Unicode

Atomic Alarm Clock 6.3 contains a stack overflow vulnerability that allows local attackers to execute arbitrary code by supplying a malicious string to the display name textbox in the Time Zones Clock configuration. Attackers can craft a buffer with structured exception handling overwrite and...

The vulnerability of the SSLVPN component of the SONICWALL network interface software of the SMA 1000 series allows a hacker to bypass the TOTP authentication process.

The vulnerability of the SSLVPN component of the SMA 1000 series SonicWALL network gateway software relates to incorrect handling of Unicode characters. Exploiting this vulnerability can allow an attacker to bypass Two-Factor Authentication TOTP verification...

The vulnerability of the Workplace/Connect tunnel of the SONICWALL series SMA 1000 microprogrammable network interface devices allows a intruder to bypass the TOTP authentication process.

The vulnerability of the Workplace/Connect microprogramming software for SONICWALL series SMA 1000 gateways is related to incorrect processing of Unicode characters. Exploiting this vulnerability can allow an attacker to bypass TOTP authentication...

Improper Handling of Unicode Encoding

Overview Affected versions of this package are vulnerable to Improper Handling of Unicode Encoding in the decoding of overlong UTF-8 strings. An attacker can bypass application-level byte filtering or validation by sending malicious sequences that decode to canonical characters. This is only...

Improper Handling of Unicode Encoding

Overview protobufjs is a protocol buffer for JavaScript & TypeScript. Affected versions of this package are vulnerable to Improper Handling of Unicode Encoding in the decoding of overlong UTF-8 strings. An attacker can bypass application-level byte filtering or validation by sending malicious...

Improper Handling of Unicode Encoding

Overview Affected versions of this package are vulnerable to Improper Handling of Unicode Encoding in the decoding of overlong UTF-8 strings. An attacker can bypass application-level byte filtering or validation by sending malicious sequences that decode to canonical characters. This is only...

CLSA-2026-1778492641 perl: Fix of 2 CVEs

CVE-2023-47038: fix write past buffer end via illegal user-defined Unicode property, for almalinux9.2esu - CVE-2025-40909: clone dirhandles without fchdir, for almalinux9.2esu...