10296 matches found
CVE-2026-45537
OpenSIPS contains a buffer overflow in construct_uri() used to assemble SIP URIs. In versions before 3.6.6 and 4.0.0-rc1, components (protocol, username, domain, port, params) are concatenated into a fixed 1024-byte global BSS buffer without bounds checks. If a routing script supplies a long, att...
CVE-2026-45537 OpenSIPS: Global Buffer Overflow in construct_uri
OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the constructuri function concatenates multiple URI components protocol, username, domain, port, params into a fixed 1024-byte global BSS buffer without any bounds checking. When a routi...
CVE-2026-69264 Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation
Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis, which on Node.js exposes eval and dynamic import,...
CVE-2026-69264
Flowise CSVAgent is affected. Prior to 3.1.3, an attacker-controlled segment of csvFile’s data URI is interpolated into a Python source-template executed by Pyodide; due to the default js bridge to globalThis in Node.js, this can be passed to js.eval and dynamically import Node built-ins (e.g., f...
CVE-2026-69264 Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation
Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis, which on Node.js exposes eval and dynamic import,...
EUVD-2026-52744
The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary...
CVE-2026-10032
The CVE-2026-10032 issue involves the openUrl function in @a2ui/web_core, which passes an agent-controlled URL directly to window.open() without URI scheme validation. A malicious actor can supply a javascript: URI as the url argument for a Button component’s functionCall action, allowing arbitra...
CLSA-2026-1784769612 TuxCare security update for fast-uri (5 CVEs)
TuxCare rebuilt fast-uri to address 5 CVEs. Fixed in 2.4.2-tuxcare.1...
CLSA-2026-1784769538 TuxCare security update for fast-uri (1 CVE)
TuxCare rebuilt fast-uri to address 1 CVE. Fixed in 3.0.1-tuxcare.2...
CLSA-2026-1784596352 TuxCare security update for fast-uri (16 CVEs)
TuxCare rebuilt fast-uri to address 16 CVEs. Fixed in 2.4.0-tuxcare.1...
CLSA-2026-1784682957 TuxCare security update for fast-uri (10 CVEs)
TuxCare rebuilt fast-uri to address 10 CVEs. Fixed in 3.0.3-tuxcare.2...
CLSA-2026-1781744129 TuxCare security update for fast-uri (33 CVEs)
TuxCare rebuilt fast-uri to address 33 CVEs. Fixed in 3.0.3-tuxcare.1...
CLSA-2026-1781744118 TuxCare security update for fast-uri (4 CVEs)
TuxCare rebuilt fast-uri to address 4 CVEs. Fixed in 3.0.1-tuxcare.1...
CLSA-2026-1780620683 TuxCare security update for decode-uri-component (3 CVEs)
TuxCare rebuilt decode-uri-component to address 3 CVEs. Fixed in 0.2.0-tuxcare.1...
CVE-2026-18446
A flaw was found in fast-uri. This vulnerability arises because fast-uri incorrectly parses Uniform Resource Identifiers URIs when a backslash is used in place of a forward slash to introduce the authority component. This discrepancy with Node's native WHATWG URL parser can lead to host confusion...
SUSE CVE-2026-18446
fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it backslash backslash, forward slash backslash, or backslash forward slash is parsed with no authority and folds into th...
DEBIAN-CVE-2026-69246
Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL handlers set CURLOPTURL to the URI exactly as written and push that Host into CURLOPTHTTPHEADER; StreamHandler does the same throu...
CVE-2026-69246
Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL handlers set CURLOPTURL to the URI exactly as written and push that Host into CURLOPTHTTPHEADER; StreamHandler does the same throu...
CVE-2026-69246 Guzzle: Noncanonical host can bypass host-based checks
Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL handlers set CURLOPTURL to the URI exactly as written and push that Host into CURLOPTHTTPHEADER; StreamHandler does the same throu...