205850 matches found
CLEANSTART-2025-VY76861 flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Do...
Security vulnerability affects the c-ares package. A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS Domain Name Servers can lead to output of wrong hostnames which might potentially lead to Domain Hijacking...
Chromium CVE-2026-85047: Improper input validation in Transactions Platform
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium CVE-2026-93387: Improper state validation in Skia
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
CLEANSTART-2026-ID88447 Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...
Security vulnerability affects the kube-state-metrics-fips package. Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped...
CLEANSTART-2026-TD83938 malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation
Security vulnerability affects the kube-state-metrics-fips package. A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation...
RLSA-2026:74085 Important: nodejs:24 security, bug fix, and enhancement update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation CVE-2026-85152 undici: undici: TLS...
nodejs:24 security, bug fix, and enhancement update
An update is available for nodejs, module.nodejs, module.nodejs-packaging, module.nodejs-nodemon, nodejs-packaging, nodejs-nodemon. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...
PT-2026-103983
Name of the Vulnerable Software and Affected Versions Joyland AI affected versions not specified Description The application fails to validate TLS certificates from servers, allowing it to accept any certificate regardless of its authenticity. This lack of validation can enable man-in-the-middle...
CVE-2026-15911: Improper Certificate Validation
Confluent Kafka Python client's HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive information due to improper TLS certificate validation...
PT-2026-103954
Name of the Vulnerable Software and Affected Versions Capacitor versions prior to 6.2.2 Capacitor versions prior to 7.6.9 Capacitor versions prior to 8.3.5 Capacitor versions prior to 8.4.3 Capacitor versions prior to 8.5.1 Description The Android and iOS WebView navigation guard validates the ho...
CVE-2026-103922: Origin Validation Error
Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame ...
PT-2026-103810
Name of the Vulnerable Software and Affected Versions Ghost versions 5.8.0 through 6.33.x Description An input validation issue exists within the admin iframe. Attackers possessing content publishing privileges can create malicious pages that, when accessed by active staff users, facilitate the...
PT-2026-103863
Name of the Vulnerable Software and Affected Versions rhukster dom-sanitizer versions prior to 1.0.16 Description A flaw in the URL Validation component allows remote attackers to cause cross site scripting. The issue resides in the DOMSanitizer::isDangerousUrl function within the...
PT-2026-103909
HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to inject unvalidated, malformed data into the application, enabling potential injection attacks or errors in downstream processing systems...
CVE-2026-102671: Improper Certificate Validation
The Joyland AI app accepts invalid SSL certificates in the invisible advertisement WebView by default...
CVE-2026-102668: Improper Certificate Validation
The Joyland AI app accepts any TLS certificates from any server without validation...
CVE-2026-103884: Improper Limitation of a Pathname to a Restricted Directory
A flaw was found in the X.509 client certificate authenticator of Keycloak. When CRL Distribution Point checking is enabled, the server fails to properly validate the file paths provided in a client certificate. An attacker can provide a specially crafted certificate that causes the server to...
thunderbird security update
140.16.0-1 - Add Oracle prefs file 140.16.0-1 - Update to 140.16.0 ESR 140.15.0-1 - Update to 140.15.0 ESR - Fix ML-DSA certificate validation Resolves: RHEL-252227...
PT-2026-103821
Name of the Vulnerable Software and Affected Versions Ghost versions 5.9.0 through 6.44.0 Description An input validation issue exists in the comments feature. This flaw allows authenticated members to access comments they are not authorized to view, leading to the disclosure of restricted commen...
