122590 matches found
CVE-2026-58181 Apache Traffic Server: uri_signing and url_sig plugins can exhaust the stack or crash
The Apache Traffic Server urisigning and urlsig plugins can exhaust the stack or crash on attacker input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which...
CVE-2026-58181
The Apache Traffic Server urisigning and urlsig plugins can exhaust the stack or crash on attacker input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which...
CVE-2026-50622
creationtimestamp| type| source ---|---|--- 2026-07-29 07:27:53+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mrrfmf67nj24 2026-07-29 10:46:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrrqpxictt2a 2026-08-06 12:07:06+00:00| seen|...
GHSA-WHMM-QJ9R-WVR2
creationtimestamp| type| source ---|---|--- 2026-07-29 05:32:47+00:00| seen| https://gist.github.com/alon710/7cdf75a52c50aebac3f872ab5cf7bfbf...
CVE-2026-17166
creationtimestamp| type| source ---|---|--- 2026-07-29 03:29:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrqycuahes2q...
CVE-2026-18072
creationtimestamp| type| source ---|---|--- 2026-07-29 02:48:40+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mrqvz4d6i72p 2026-07-29 05:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrra5ix6zt2y 2026-07-29 06:43:40+00:00| seen|...
The vulnerability of the isInternalPath() function in the web framework Astro, which allows attackers to carry out phishing attacks.
The vulnerability of the isInternalPath function in the web framework Astro relates to the redirection of URLs to unreliable websites. Exploiting this vulnerability could allow a remote attacker to carry out phishing attacks...
PT-2026-76533
On Unix platforms handled by src/unix.rs, affected versions substitute the caller-supplied URL into the BROWSER environment-variable template before tokenizing the resulting string with split ascii whitespace. If an application passes an attacker-controlled non-HTTPS URL whose parsed form retains...
PT-2026-65885
Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 14.0 through 19.0.4 GitLab CE/EE versions 19.1 through 19.1.2 GitLab CE/EE versions 19.2 through 19.2.0 Description Improper sanitization of user-controlled input in the pagination page rendering mechanism allows a remote...
CVE-2026-58156: Incorrect Authorization
Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which f...
CVE-2026-3093: Improper Neutralization of Input During Web Page Generation
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an attacker to execute arbitrary JavaScript in another user's browser via a crafted URL, due to improper...
PT-2026-65758
Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 8.0.0 through 8.1.9 Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3 Description The uri signing and url sig plugins can exhaust the stack or crash when...
Linux Distros Unpatched Vulnerability : CVE-2026-58181
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Apache Traffic Server urisigning and urlsig plugins can exhaust the stack or crash on attacker input. This issue affects Apache Traffic Server: from 8.0.0...
NewStart CGSL MAIN 6.06 : docker-image-check Multiple Vulnerabilities (NS-SA-2026-0055)
The remote NewStart CGSL host, running version MAIN 6.06, has docker-image-check packages installed that are affected by multiple vulnerabilities: - net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications...
CVE-2026-49258
creationtimestamp| type| source ---|---|--- 2026-07-28 23:00:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrqjasdbre2q...
CVE-2026-14974
creationtimestamp| type| source ---|---|--- 2026-07-28 22:57:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrqj3vwx3u2q 2026-07-30 05:15:09+00:00| seen| https://www.hkcert.org/security-bulletin/ibm-websphere-products-multiple-vulnerabilities20260730...
CVE-2026-14973
creationtimestamp| type| source ---|---|--- 2026-07-28 22:55:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrqixfdrvf2a 2026-07-28 23:46:03+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrqlslhnyj2j 2026-07-29 02:03:47+00:00| seen|...
openhole-server vulnerable to path traversal via URL-decoded request path
Summary openhole-server forwarded the URL-decoded request path r.URL.Path to tunnel clients instead of the original request-target. Percent-encoded dot-segments %2e and separators %2f were decoded to ../ and / before reaching the local service. Go's ServeMux rejects literal ../ paths, but...
CVE-2026-54691
datamodel-code-generator generates Python data models from schema definitions. From 0.9.1 until 0.61.0, src/datamodelcodegenerator/http.py http.getbody accepts --url targets and redirect chain targets without host/IP validation, allowing server-side request forgery against loopback, private,...
CVE-2026-66064
goshs is affected by an ACL/Path Traversal vulnerability in the httpserver/handler.go sendFile logic prior to version 2.1.5. The authorization filename was derived from raw req.URL.Path while using a cleaned path for file access, allowing a trailing slash to bypass .goshs ACL-file protection and ...