3859 matches found
CVE-2026-54773 CoreWCF: WS-Security signature substitution via document-wide Signature lookup
CoreWCF is a port of the service side of Windows Communication Foundation WCF to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF WS-Security signature verification performs a document-wide ds:Signature lookup, allowing an unauthenticated remote attacker to place a SOAP header before wsse:Security an...
CVE-2026-54773
CoreWCF WS-Security signature substitution vulnerability: prior to versions 1.8.1 and 1.9.1, WS-Security verification performs a document-wide ds:Signature lookup, allowing an unauthenticated remote attacker to place a SOAP header before wsse:Security and cause attacker-supplied ds:Signature to b...
CVE-2026-54773 CoreWCF: WS-Security signature substitution via document-wide Signature lookup
CoreWCF is a port of the service side of Windows Communication Foundation WCF to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF WS-Security signature verification performs a document-wide ds:Signature lookup, allowing an unauthenticated remote attacker to place a SOAP header before wsse:Security an...
CVE-2026-58501
Zeep is a Python SOAP client. From 4.0.0 before 4.3.3, Settings.forbidexternal is defined but not enforced when parsing WSDL or XSD documents, allowing transitive xsd:import, xsd:include, wsdl:import, and lxml entity or DTD references to fetch attacker-chosen HTTP or HTTPS URLs. This issue is fix...
CVE-2026-58501
Zeep is a Python SOAP client. From 4.0.0 before 4.3.3, Settings.forbidexternal is defined but not enforced when parsing WSDL or XSD documents, allowing transitive xsd:import, xsd:include, wsdl:import, and lxml entity or DTD references to fetch attacker-chosen HTTP or HTTPS URLs. This issue is fix...
CVE-2026-58501 Zeep SSRF because Settings.forbid_external is not enforced
Zeep is a Python SOAP client. From 4.0.0 before 4.3.3, Settings.forbidexternal is defined but not enforced when parsing WSDL or XSD documents, allowing transitive xsd:import, xsd:include, wsdl:import, and lxml entity or DTD references to fetch attacker-chosen HTTP or HTTPS URLs. This issue is fix...
CVE-2026-59897
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.3.3 before 4.12.27, the AWS API Gateway v1 adapter can drop a distinct repeated request header value because it de-duplicates values using a substring comparison instead of an exact match, so middleware o...
CVE-2026-53149 vulnerabilities
Vulnerabilities for packages: linux-azure, linux-qemu, linux-gcp, linux-vmware, linux-qemu-melange, linux-aws...
CVE-2026-53168 vulnerabilities
Vulnerabilities for packages: linux-azure, linux-qemu, linux-gcp, linux-vmware, linux-qemu-melange, linux-aws...
CVE-2026-53212 vulnerabilities
Vulnerabilities for packages: linux-azure, linux-qemu, linux-gcp, linux-vmware, linux-qemu-melange, linux-aws...
CVE-2026-53228 vulnerabilities
Vulnerabilities for packages: linux-azure, linux-qemu, linux-gcp, linux-vmware, linux-qemu-melange, linux-aws...
GHSA-38RG-2RJC-3RMJ vulnerabilities
Vulnerabilities for packages: linux-azure, linux-qemu, linux-gcp, linux-vmware, linux-qemu-melange, linux-aws...
GHSA-3J78-PF43-6MVQ vulnerabilities
Vulnerabilities for packages: linux-azure, linux-qemu, linux-gcp, linux-vmware, linux-qemu-melange, linux-aws...
GHSA-4PQW-3H25-QRQ3 vulnerabilities
Vulnerabilities for packages: linux-azure, linux-qemu, linux-gcp, linux-vmware, linux-qemu-melange, linux-aws...
GHSA-5Q2P-7748-G6QP vulnerabilities
Vulnerabilities for packages: linux-azure, linux-qemu, linux-gcp, linux-vmware, linux-qemu-melange, linux-aws...
GHSA-6GQ6-HXJH-9GRQ vulnerabilities
Vulnerabilities for packages: linux-azure, linux-qemu, linux-gcp, linux-vmware, linux-qemu-melange, linux-aws...
GHSA-F3Q5-7M6P-4QXQ vulnerabilities
Vulnerabilities for packages: linux-azure, linux-qemu, linux-gcp, linux-vmware, linux-qemu-melange, linux-aws...
GHSA-HFRJ-R4V7-3997 vulnerabilities
Vulnerabilities for packages: linux-azure, linux-qemu, linux-gcp, linux-vmware, linux-qemu-melange, linux-aws...