8570 matches found
CVE-2026-23957 seroval is vulnerable to Denial of Service via array serialization
seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, overriding encoded array lengths by replacing them with an excessively large value causes the deserialization process to significantly increase processing...
[SECURITY] Fedora 42 Update: rpki-client-9.7-1.fc42
The OpenBSD rpki-client is a free, easy-to-use implementation of the Resource Public Key Infrastructure RPKI for Relying Parties RP to facilitate validation of the Route Origin of a BGP announcement. The program queries the RPKI repository system, downloads and validates Route Origin Authorisatio...
CVE-2025-64097: Use of Insufficiently Random Values
NervesHub is a web service that allows users to manage over-the-air OTA firmware updates of devices in the field. A vulnerability present starting in version 1.0.0 and prior to version 2.3.0 allowed attackers to brute-force user API tokens due to the predictable format of previously issued tokens...
HUSTOJ security vulnerabilities
HUSTOJ is a popular OJ system developed by Zhang Haobin zhblue from China. HUSTOJ has security vulnerabilities; these vulnerabilities arise from the application not cleaning the input provided by users before exporting it to .xls files. This may lead to CSV injection and arbitrary command executi...
EUVD-2026-3521
When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters...
ROS-20260121-73-0012
A vulnerability in the blkdevreaditer function of the block/fops.c component of the Linux kernel is related to an unverified return value. Exploitation of the vulnerability could allow an attacker to cause a denial of service...
CVE-2026-0672
When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters...
AZL-75026 CVE-2026-0672 affecting package python3 for versions less than 3.12.9-8
When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters...
DEBIAN-CVE-2026-0672
When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters...
UBUNTU-CVE-2026-0672
When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters...
CVE-2026-0672
When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters...
CVE-2026-0672 Header injection in http.cookies.Morsel
When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters...
CVE-2026-0672
When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters...
PSF-2026-5
When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters...
CVE-2026-0672 Header injection in http.cookies.Morsel
When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters...
CVE-2026-0672
When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters...
binary-parser library has a code injection vulnerability
A code injection vulnerability in the binary-parser library prior to version 2.3.0 allows arbitrary JavaScript code execution when untrusted values are used in parser field names or encoding parameters. The library directly interpolates these values into dynamically generated code without...
CVE-2026-0865
User-controlled header names and values containing newlines can allow injecting HTTP headers...
CVE-2026-0865
CVE-2026-0865: Python’s wsgiref.headers allows header newline injection via user-controlled header names/values. Affects CPython components handling HTTP headers; multiple OS vendors reference this in advisories (e.g., RHSA-2026:2128, USN-8018-1, ALSA-2026:2128, DLA-4455). Mitigation is to upgrad...