206074 matches found
Rocky Linux 10.2 [CIQ] Security Update: osbuild-composer / osbuild-composer-core / etc Multiple Vulnerabilities (crlsa-2026_65895)
The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202665895 advisory. crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application CVE-2026-33810 net/mail: golang: net/mai...
Rocky Linux 10.2 [CIQ] Security Update: go-fdo-client / go-fdo-client-debuginfo / go-fdo-client-debugsource Multiple Vulnerabilities (crlsa-2026_62577)
The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202662577 advisory. crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application CVE-2026-33810 encoding/asn1: golang: Go...
Rocky Linux 10.2 [CIQ] Security Update: buildah / buildah-debuginfo / buildah-debugsource / buildah-tests / etc Multiple Vulnerabilities (crlsa-2026_63332)
The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202663332 advisory. crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application CVE-2026-33810 net/mail: golang: net/mai...
Rocky Linux 10.2 [CIQ] Security Update: podman / podman-debuginfo / podman-debugsource / podman-docker / etc Multiple Vulnerabilities (crlsa-2026_70201)
The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202670201 advisory. podman: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application CVE-2026-33810 podman: Go net/http: Unencrypted HTTP/...
Rocky Linux 10.2 [CIQ] Security Update: go-fdo-server / go-fdo-server-debuginfo / go-fdo-server-debugsource / etc Multiple Vulnerabilities (crlsa-2026_62578)
The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202662578 advisory. crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application CVE-2026-33810 encoding/asn1: golang: Go...
EUVD-2026-90388
PyJWT.decode reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse...
fastify vulnerable to request body replacement via an async validation result collision
Impact Fastify runs a route's validator and, for a result shaped like value, error , unwraps it: an error becomes a validation failure and value replaces the request part. This convention is intended for synchronous custom compilers for example Joi. A JSON Schema $async validator, however, resolv...
NPM: fastify vulnerable to request body replacement via an async validation result collision
NPM: fastify vulnerable to request body replacement via an async validation result collision vulnerability discovered by ? in WordPress Npm fastify versions 5.12.2...
NPM: fastify vulnerable to request validation bypass via skipped boolean false schemas
NPM: fastify vulnerable to request validation bypass via skipped boolean false schemas vulnerability discovered by ? in WordPress Npm fastify versions 5.12.2...
fastify vulnerable to request validation bypass via skipped boolean false schemas
Impact Fastify decided whether to validate a request part by checking its schema for JavaScript truthiness. JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance, but because false is falsy, a route that set body, querystring, params, or headers to false had...
EUVD-2026-70989
fastify vulnerable to request validation bypass via skipped boolean false schemas...
GHSA-HWR6-493R-VM6H fastify vulnerable to request validation bypass via skipped boolean false schemas
Impact Fastify decided whether to validate a request part by checking its schema for JavaScript truthiness. JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance, but because false is falsy, a route that set body, querystring, params, or headers to false had...
GHSA-9Q9J-Q6P8-XQ58 fastify vulnerable to header validation bypass via incomplete schema case normalization
Impact Fastify lowercases header-schema property names before compiling the schema, because Node.js stores request header names in lowercase. That normalization was incomplete: it lowercased only top-level properties keys and the root required array, and did not lowercase the JSON Schema Draft 7...
NPM: fastify vulnerable to header validation bypass via incomplete schema case normalization
NPM: fastify vulnerable to header validation bypass via incomplete schema case normalization vulnerability discovered by ? in WordPress Npm fastify versions 5.12.2...
fastify vulnerable to header validation bypass via incomplete schema case normalization
Impact Fastify lowercases header-schema property names before compiling the schema, because Node.js stores request header names in lowercase. That normalization was incomplete: it lowercased only top-level properties keys and the root required array, and did not lowercase the JSON Schema Draft 7...
CVE-2026-103001
A flaw was found in pyjwt. This vulnerability allows a remote attacker to bypass token validation checks when an application reuses an options configuration across multiple token decoding requests. Because the library unintentionally modifies the caller's shared configuration dictionary when...
EUVD-2026-74843
GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution...
Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange
Vulnerability The hybrid ML-KEM 768 + X25519 key exchange implementation in russh/src/kex/hybridmlkem.rs does not validate that the remote peer's X25519 public key is not the zero point all-zero 32-byte value. This allows a remote peer to force the X25519 contribution to the combined shared secre...
CVE-2026-103001
PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT.mergeoptions method can modify a caller-supplied mutable options mapping when verifysignature is false. If an application reuses that same mapping for a later decode or decodecomplete call and...
Important: Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update
An update for the nodejs:24 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...