3271 matches found
CVE-2026-84469 fastify vulnerable to request validation bypass via skipped boolean false schemas
fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to a route's body, querystring, params, or headers schema to...
CVE-2026-81666
An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an...
Incorrect Behavior Order: Early Validation
Overview fastify is an overhead web framework, for Node.js. Affected versions of this package are vulnerable to Incorrect Behavior Order: Early Validation through the request validation path in lib/validation.js. An attacker can replace the validated request body, or trigger a validation failure,...
Sort Validation Bypass
org.springframework.data, spring-data-jpa is vulnerable to a Sort validation bypass. The vulnerability is due to insufficient validation of crafted Sort parameters received from untrusted sources, which allows an attacker to bypass sorting validation and potentially inject malicious sorting...
PT-2026-85467
Name of the Vulnerable Software and Affected Versions fastify versions prior to 5.12.2 Description Fastify incorrectly determines whether to compile a request schema based on JavaScript truthiness. According to JSON Schema Draft 7, a boolean false is a valid schema that rejects all instances...
PT-2026-85800
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ocfs2 read blocks function regarding buffer head management. The function incorrectly assumes that the buffer head returned by sb getblk is exclusively owned,...
CVE-2026-84469: Improper Input Validation
fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to a route's body, querystring, params, or headers schema to...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libevent (UTSA-2026-106162)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106162 advisory. Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttpdecodeuriinternal decodes...
RockyLinux 10 : buildah (RLSA-2026:63332)
The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:63332 advisory. crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application CVE-2026-33810 net/mail: golang: net/mai...
CVE-2026-85239
A vulnerability in MISP's event template handling allowed an authenticated user with permission to create or modify event templates to bypass validation of the template definition field. The EventTemplate::beforeValidate method only performed semantic validation when the supplied definition was...
EUVD-2026-70598
PlaywrightCapture contains a server-side request forgery SSRF vulnerability in its favicon retrieval functionality. When onlygloballookup is enabled, the application validates the initial favicon URL to prevent requests to localhost, loopback, or other non-public network addresses. However,...
CVE-2026-85239 MISP Event Template Definition Validation Bypass Allows Persistent Denial of Service
A vulnerability in MISP's event template handling allowed an authenticated user with permission to create or modify event templates to bypass validation of the template definition field. The EventTemplate::beforeValidate method only performed semantic validation when the supplied definition was...
EUVD-2026-70533
A vulnerability in MISP's event template handling allowed an authenticated user with permission to create or modify event templates to bypass validation of the template definition field. The EventTemplate::beforeValidate method only performed semantic validation when the supplied definition was...
CVE-2026-85239 MISP Event Template Definition Validation Bypass Allows Persistent Denial of Service
A vulnerability in MISP's event template handling allowed an authenticated user with permission to create or modify event templates to bypass validation of the template definition field. The EventTemplate::beforeValidate method only performed semantic validation when the supplied definition was...
CVE-2026-85239
MISP is vulnerable to a validation bypass in its event template handling. The EventTemplate::beforeValidate() method only applied semantic validation when the definition was already an array; a caller supplying a pre-encoded string (including malformed JSON ) bypassed validateDefinition() and onl...
CVE-2026-85239 MISP Event Template Definition Validation Bypass Allows Persistent Denial of Service
A vulnerability in MISP's event template handling allowed an authenticated user with permission to create or modify event templates to bypass validation of the template definition field. The EventTemplate::beforeValidate method only performed semantic validation when the supplied definition was...
RLSA-2026:62578 Important: go-fdo-server security update
This package provides a server-side implementation of the FIDO Device Onboard FDO specification, written in Go. FDO is an open standard for the late binding of device credentials, allowing for automated and secure on-boarding of devices when they are first powered on in their final location...
go-fdo-server security update
An update is available for go-fdo-server. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list This package provides a server-side implementation of the FIDO Device...
go-fdo-client security update
An update is available for go-fdo-client. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list go-fdo-client is the device-side implementation of FIDO Device Onboard...
erlang: Erlang OTP public_key: Certificate validation bypass allows hostname spoofing
A flaw was found in Erlang OTP publickey. This improper certificate validation vulnerability allows a subordinate Certificate Authority CA with restricted DNS nameConstraints to bypass these restrictions. By issuing a leaf certificate that lacks a Subject Alternative Name SAN but contains a craft...