94226 matches found
Coraza Body Processor Has A JSON Key Collision That Allows Unauthenticated Attackers To Bypass OWASP CRS Inspection
Summary Coraza's JSON body processor converts nested JSON properties into dot-separated "ARGSPOST" names without escaping dots contained in literal property names. Two distinct JSON properties can therefore collapse into the same Coraza variable An unauthenticated attacker can place a malicious...
sudo: sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization
A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an...
Important: Red Hat Security Advisory: sudo security update
An update for sudo is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System...
Security Bulletin: Multiple Vulnerabilities in IBM Data Product Hub
Summary Multiple vulnerabilities were addressed in IBM Data Product Hub version 5.4.0 Patch 8 Vulnerability Details CVEID:CVE-2026-75899 DESCRIPTION: fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time...
ApostropheCMS: Exposure of Sensitive Information via predictable export filenames
Summary When a user exports content through @apostrophecms/import-export, the module copies the generated archive into uploadfs at /exports/ and returns a public URL under /uploads/exports/. The filename is fully deterministic: site shortName, document type, a YYYYMMDDHHmmss timestamp, and the...
crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec
A flaw was found in the Golang crypto/internal/nistec package. Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Considering how this function is used, this leaka...
Coraza: Multipart Filename* (RFC 5987) Charset Restriction Lets A Decoy Filename Bypass FILES-based Rules
Summary Coraza extracts a multipart file upload's filename using Go's standard-library "mime.ParseMediaType", which only decodes the RFC 5987/6266 extended "filename" "Content-Disposition" parameter when its declared charset is exactly "us-ascii" or "utf-8". Any other charset — including...
CVE-2026-78117
The Infineon PSOC 6 BLESS HCI driver in drivers/bluetooth/hci/hciinfineonpsoc6bless.c stored the outgoing HCI packet descriptor in a file-scope variable, static cystcblehcitxpacketinfot hcitxpkt. psoc6blesssend cleared and populated that descriptor's packetType, dataLength and data fields before...
Exploit for CVE-2026-109618
PHP2Shell: Mitigation and Remediation Guide Date: 21 Octo...
Security Bulletin: IBM Guardium Data Security Center is affected by multiple vulnerabilities
Summary IBM Guardium Data Security Center has addressed these vulnerabilties in an update. Vulnerability Details CVEID:CVE-2026-78662 DESCRIPTION: Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's...
Exploit for CVE-2026-109618
⚡ php2shell: Pre-Auth Remote Code Execution in PHP Core I...
crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec
A flaw was found in the Golang crypto/internal/nistec package. Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Considering how this function is used, this leaka...
Exploit for CVE-2026-109618
php2shell-check bash sudo python3 php2shellcheck.py...
CVE-2026-78117 Race condition on shared HCI TX descriptor in the Infineon PSOC 6 BLESS Bluetooth driver can leak adjacent memory over the air
The Infineon PSOC 6 BLESS HCI driver in drivers/bluetooth/hci/hciinfineonpsoc6bless.c stored the outgoing HCI packet descriptor in a file-scope variable, static cystcblehcitxpacketinfot hcitxpkt. psoc6blesssend cleared and populated that descriptor's packetType, dataLength and data fields before...
CVE-2026-78117 Race condition on shared HCI TX descriptor in the Infineon PSOC 6 BLESS Bluetooth driver can leak adjacent memory over the air
The Infineon PSOC 6 BLESS HCI driver in drivers/bluetooth/hci/hciinfineonpsoc6bless.c stored the outgoing HCI packet descriptor in a file-scope variable, static cystcblehcitxpacketinfot hcitxpkt. psoc6blesssend cleared and populated that descriptor's packetType, dataLength and data fields before...
CVE-2026-78117 Race condition on shared HCI TX descriptor in the Infineon PSOC 6 BLESS Bluetooth driver can leak adjacent memory over the air
The Infineon PSOC 6 BLESS HCI driver in drivers/bluetooth/hci/hciinfineonpsoc6bless.c stored the outgoing HCI packet descriptor in a file-scope variable, static cystcblehcitxpacketinfot hcitxpkt. psoc6blesssend cleared and populated that descriptor's packetType, dataLength and data fields before...
EUVD-2026-107484
The Infineon PSOC 6 BLESS HCI driver in drivers/bluetooth/hci/hciinfineonpsoc6bless.c stored the outgoing HCI packet descriptor in a file-scope variable, static cystcblehcitxpacketinfot hcitxpkt. psoc6blesssend cleared and populated that descriptor's packetType, dataLength and data fields before...
CVE-2026-78117
The Infineon PSOC 6 BLESS HCI driver (specifically in drivers/bluetooth/hci/hci_infineon_psoc6_bless.c) is vulnerable to a race condition due to the use of a file-scope variable, static cy_stc_ble_hci_tx_packet_info_t hci_tx_pkt, to store outgoing HCI packet descriptors. Because psoc6_bless_send(...
DRUPAL-CONTRIB-2026-245
This module allows for direct viewing of a file with the URL alias. In some cases, files may be served with the HTTP header Cache-Control: public when they should be uncacheable. This can lead to some users getting cached versions of files with information they should not be able to access. This...