177644 matches found
net/url: Incorrect parsing of IPv6 host literals in net/url
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...
net/url: Incorrect parsing of IPv6 host literals in net/url
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...
EUVD-2026-54961
A Server-Side Request Forgery SSRF vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The nltk.pathsec.validatenetworkurl function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space 100.64.0.0/1...
PT-2026-69654
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Variable Refresh Rate VRR implementation where the system fails to explicitly ensure that the minimum and maximum vertical frequencies vfreq provided by the Extend...
Linux Distros Unpatched Vulnerability : CVE-2026-68097
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: validate ACE size against SID sub-authorities setntacldacl validates sid.numsubauth before copying an ACE, but does not verify that the declared ACE size...
Debian dsa-6425 : openjdk-21-dbg - security update
The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6425 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6425-1 [email protected] https://www.debian.org/securit...
Linux Distros Unpatched Vulnerability : CVE-2026-68206
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: v4l2-ctrls: validate HEVC active reference counts HEVC slice parameters are shared stateless V4L2 controls, but the common validation path does not verif...
PT-2026-69966
Name of the Vulnerable Software and Affected Versions odh-dashboard affected versions not specified Description An authenticated user can exploit a flaw in the creation of RoleBindings. The system fails to properly validate the roleRef field, enabling a user to assign arbitrary roles, such as...
PT-2026-69384
Name of the Vulnerable Software and Affected Versions Samsung Contacts versions prior to SMR Aug-2026 Release 1 Description Improper input validation allows local attackers to delete files using the privileges of Samsung Contacts. Recommendations Update Samsung Contacts to SMR Aug-2026 Release 1...
Linux Distros Unpatched Vulnerability : CVE-2026-68297
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tipc: fix u16 MTU truncation in media and bearer MTU validation Both TIPCNLMEDIASET and TIPCNLBEARERSET accept user-supplied MTU values but only enforce a minim...
PT-2026-69743
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SMB client where the parse dfs referrals function fails to validate the PathConsumed value in a response. If a malformed response provides a PathConsumed value...
Cisco Integrated Management Controller Argument Injection (CVE-2026-20288) (cisco-sa-cimc-arg-inject-upSHdMfU)
According to its self-reported version, Cisco Integrated Management Controller is affected by a vulnerability. - A command injection vulnerability exists in the web-based management interface of Cisco Integrated Management Controller IMC due to improper validation of user-supplied input. An...
DEBIAN-CVE-2026-12372
A Server-Side Request Forgery SSRF vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The nltk.pathsec.validatenetworkurl function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space 100.64.0.0/1...
CVE-2026-12372
A Server-Side Request Forgery SSRF vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The nltk.pathsec.validatenetworkurl function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space 100.64.0.0/1...
langflow-exploit
CVE-2025-3248 - Langflow Code Validation Endpoint RCE A proof...
Exploit for CVE-2026-64638
CVE-2026-64638 — XSS2Shell Proof of Concept A proof-of-concep...
Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack
...
EUVD-2026-54895
The WP Data Access WordPress plugin before 5.5.79 does not validate the column names it accepts on one of its unauthenticated AJAX actions, and the nonce guarding that action does not cover them, allowing unauthenticated attackers to read arbitrary columns of the database table the affected...
Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection
The rise of autonomous AI agents represents a major paradigm shift in how users interact with mobile devices. Frameworks such as MobileRun and Mobile-Use can autonomously navigate Android applications and execute complex multi-step tasks. To interpret user interfaces, these frameworks rely...
CVE-2026-16282
The Appointment Hour Booking WordPress plugin before 1.5.88 does not validate a client-supplied booking price against the server-side configured service price, allowing unauthenticated users to submit an arbitrary final price including zero or negative that is stored as the authoritative booking...