107 matches found
CVE-2026-116304
A flaw was found in PostgreSQL. An authenticated database user can exploit this vulnerability to execute arbitrary code with the privileges of the operating system user running the database. This issue stems from a use-after-free condition during the coordination of anonymous RECORD type...
CVE-2026-127141
SOGo before 5.12.13 contains a denial of service vulnerability that allows authenticated attackers to exhaust all worker processes by configuring an auxiliary IMAP mail account pointing to a controlled host that accepts a TCP connection but never sends an IMAP greeting response. Attackers can iss...
CVE-2026-127141 SOGo before 5.12.13 Denial of Service via Auxiliary IMAP Account Greeting Wait
SOGo before 5.12.13 contains a denial of service vulnerability that allows authenticated attackers to exhaust all worker processes by configuring an auxiliary IMAP mail account pointing to a controlled host that accepts a TCP connection but never sends an IMAP greeting response. Attackers can iss...
EUVD-2026-124533
SOGo before 5.12.13 contains a denial of service vulnerability that allows authenticated attackers to exhaust all worker processes by configuring an auxiliary IMAP mail account pointing to a controlled host that accepts a TCP connection but never sends an IMAP greeting response. Attackers can iss...
CVE-2026-127141
SOGo versions prior to 5.12.13 are vulnerable to a denial of service (DoS) attack. An authenticated attacker can exhaust all worker processes by configuring an auxiliary IMAP mail account pointing to a controlled host that accepts a TCP connection but fails to send an IMAP greeting response . By ...
CVE-2026-127141 SOGo before 5.12.13 Denial of Service via Auxiliary IMAP Account Greeting Wait
SOGo before 5.12.13 contains a denial of service vulnerability that allows authenticated attackers to exhaust all worker processes by configuring an auxiliary IMAP mail account pointing to a controlled host that accepts a TCP connection but never sends an IMAP greeting response. Attackers can iss...
CVE-2026-115817
A flaw was found in Starman. A remote attacker can cause a Denial of Service DoS by sending complete HTTP request headers and then stalling or slowly transmitting the request body. Because request bodies are read without enforcing an active timeout deadline, worker processes remain blocked...
NGINX 1.31.6 Alias Rewrite Heap Overflow
NGINX versions 0.1.29 through 1.31.6 contain a heap buffer overflow in worker processes when an alias location changes the request URI with rewrite before mapping it to a file path. A remote attacker may cause a denial of service or possibly execute arbitrary code...
Semantic MediaWiki resource management error vulnerability
Versions of Semantic MediaWiki from 3.0.0 up to but not including 7.3.1 contain a resource management vulnerability. This vulnerability stems from an algorithm complexity issue in TermParser::normalizecompactform. Unauthenticated attackers can exploit this by submitting long search queries...
Pascal Buchbinder mod_qos buffer error vulnerability
Versions 11.74, 11.76, and 11.79 of Pascal Buchbinder’s modqos contain a buffer error vulnerability. This vulnerability arises when processing percent-encoded inputs during JSON body filtering; improper termination of strings can lead to reading beyond allocated memory boundaries. As a result,...
ALPINE-CVE-2026-93546
Integer overflow in moddavfs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces...
CVE-2026-93546 Apache HTTP Server: mod_dav_fs namespace overflow
Integer overflow in moddavfs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces...
Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : Mistral vulnerability (USN-8422-1)
The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8422-1 advisory. Eduardo Gonzalez Gutierrez and Arnaud Morin discovered that Mistral did not properly enforce access policies on some API endpoints...
Authentication Bypass
Spring gRPC is vulnerable to Authentication Bypass. The vulnerability is due to improper clearing of the authenticated security context on gRPC worker threads, where a previously authenticated identity may persist after an access denial and be reused by a subsequent request, potentially leading t...
JLSEC-2026-35
A flaw was found in postgresql. A purpose-crafted query can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can complete this attack at will. The attack does not require the ability to create objects. If server settings include...
CVE-2026-27651
When the ngxmailauthhttpmodule module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes to terminate. This issue may occur when 1 CRAM-MD5 or APOP authentication is enabled, and 2 the authentication server permits retry by returning the Auth-Wait...
CVE-2026-27651: NULL Pointer Dereference
When the ngxmailauthhttpmodule module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes to terminate. This issue may occur when 1 CRAM-MD5 or APOP authentication is enabled, and 2 the authentication server permits retry by returning the Auth-Wait...
Important: Red Hat Security Advisory: yggdrasil security update
An update for yggdrasil is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...