68710 matches found
net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
A flaw was found in the HTTP/2 protocol implementation within the Go standard library golang.org/x/net and net/http/internal/http2. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGSMAXFRAMESIZE parameter set to zero. This...
golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...
CVE-2026-69183
Monkeytype (a typing test application) versions 26.26.0 and earlier contain a rate-limit bypass in the backend key generator (backend/src/middlewares/rate-limit.ts). The generator prioritizes client-controlled cf-connecting-ip and x-forwarded-for headers over the trust-proxy-derived req.ip, allow...
CVE-2026-69183 Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)
Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...
CVE-2026-63044
CVE-2026-63044 is a Server-Side Request Forgery (SSRF) vulnerability in Apache InLong Manager , affecting versions 2.0.0 through before 2.4.0 . Any authenticated user (no admin role required) can abuse the POST /api/node/testConnection endpoint to force the server to make outbound HTTP requests o...
CVE-2026-63039
CVE-2026-63039 is an SQL injection (CWE-89) in Apache InLong's manager component, specifically in AuditAlertRuleEntityMapper.selectByCondition. The root cause is MyBatis ${} string interpolation of attacker-controlled orderField and orderType fields in the ORDER BY clause, allowing arbitrary SQL ...
EUVD-2026-63398
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This appears to allow SQL injection in the ORDER BY clause against the Manager backend database. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgra...
CVE-2026-76928
A flaw in Wireshark's X.509IF protocol dissector allows a remote attacker to cause a Denial of Service DoS. By providing a specially crafted capture file or network stream, an attacker can crash the application, making it unavailable. Mitigation Avoid opening untrusted capture files or monitoring...
golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...
EUVD-2026-63166
X.509IF protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...
mysql:8.4 security, bug fix, and enhancement update
An update is available for module.mysql, rapidjson, module.mecab-ipadic, mysql, mecab-ipadic, module.rapidjson, mecab, perl-DBD-MySQL, module.mecab, module.perl-DBD-MySQL. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...
Deserialization of Untrusted Data
Overview org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the deserialization. An attacker can execute arbitrary code by submitting a crafted GraphQL request containing...
Linux Distros Unpatched Vulnerability : CVE-2026-76928
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - X.509IF protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service CVE-2026-76928 Note that Nessus relies on the presence of the...
PT-2026-79045
Name of the Vulnerable Software and Affected Versions Apache InLong versions 2.0.0 through 2.3.x Description An issue exists where StreamSource performs no authorization check, allowing any authenticated user to logically delete all stream sources. Recommendations Upgrade to version 2.4.0...
PT-2026-79386
Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.4.21 Description Unauthenticated remote attackers can execute arbitrary code due to a code injection flaw. This issue occurs when the analyse resultat skel function mishandles the X-Spip-Filtre HTTP request header. Thi...
AZL-96833 CVE-2026-76928 affecting package wireshark 4.4.7-2
X.509IF protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...
DEBIAN-CVE-2026-76928
X.509IF protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...
CVE-2026-76928
X.509IF protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...
