AlmaLinux 9.6 [TuxCare] Security Update: grafana / grafana-selinux (ALMALINUX9.6:CLSA-2026:1776070934)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1776070934 advisory. - url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 Note that Nessus has not...

Rocky Linux 9.6 [TuxCare] Security Update: buildah / buildah-tests (ALMALINUX9.6:CLSA-2026:1778254382)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778254382 advisory. - url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 Note that Nessus has not...

AlmaLinux 9.6 [TuxCare] Security Update: buildah / buildah-tests (ALMALINUX9.6:CLSA-2026:1778254382)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778254382 advisory. - url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 Note that Nessus has not...

Rocky Linux 9.6 [TuxCare] Security Update: grafana / grafana-selinux (ALMALINUX9.6:CLSA-2026:1776070934)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1776070934 advisory. - url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 Note that Nessus has not...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git-lfs (UTSA-2026-124465)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-124465 advisory. url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. Tenable has extracted the preceding description block directly from t...

Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-25679 DESCRIPTION: url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CWE:CWE-425: Direct Request 'Forced...

CVE-2026-40280: Server-Side Request Forgery (SSRF)

Gotenberg is an API-based document conversion tool. In versions 8.30.1 and earlier, the default private-IP deny-lists for the --webhook-deny-list and --api-download-from-deny-list flags use a case-sensitive regular expression ^https?:// to match URL schemes. Because Go's net/url.Parse normalizes...

OESA-2026-1792 golang security update

. Security Fixes: url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.CVE-2026-25679 On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which...

OESA-2026-1793 golang security update

. Security Fixes: url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.CVE-2026-25679 On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which...

AZL-79671 CVE-2026-25679 affecting package golang for versions less than 1.2.58-1

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs...

CVE-2026-25679

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs...

PT-2026-28978

Уязвимость функции url.Parse компонента host/authority языка программирования Go связана с неправильной проверкой синтаксической корректности ввода. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, выполнить произвольный код...

CVE-2026-25679: Direct Request

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs...

AZL-98817 CVE-2025-47912 affecting package golang 1.27.1-1

The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://::1/". IPv4 addresses and hostnames mus...

Input validation

Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse function. When new URL throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect...

CVE-2023-26159

Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse function. When new URL throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect...

CVE-2023-26159: Improper Input Validation

Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse function. When new URL throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect...

CVE-2022-25295 Open Redirect

This affects the package github.com/gophish/gophish before 0.12.0. The Open Redirect vulnerability exists in the next query parameter. The application uses url.Parser.FormValue"next" to extract path and eventually redirect user to a relative URL, but if next parameter starts with multiple...

CVE-2022-25295

This affects the package github.com/gophish/gophish before 0.12.0. The Open Redirect vulnerability exists in the next query parameter. The application uses url.Parser.FormValue"next" to extract path and eventually redirect user to a relative URL, but if next parameter starts with multiple...

CVE-2022-25295: URL Redirection to Untrusted Site

This affects the package github.com/gophish/gophish before 0.12.0. The Open Redirect vulnerability exists in the next query parameter. The application uses url.Parser.FormValue"next" to extract path and eventually redirect user to a relative URL, but if next parameter starts with multiple...