32226 matches found
Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification
...
Twisted: IMAP wildcardToRegexp() ReDoS
...
In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.
...
In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.
...
In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.
...
In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.
...
In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges. This is related to the GatewayPorts and StreamLocalForwarding configuration options, and lack of support for file-descriptor passing and unprivileged allocation of PTY devices.
...
In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams" findings.
...
In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.
...
In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.
...
In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.
...
In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.
...
HDF5 heap buffer overflow in H5VM_array_fill via crafted fill-value metadata
...
HDF5 scale-offset filter heap buffer over-read via crafted chunk
...
Apache Thrift: Lua `TJsonProtocol` string/number readers have no size bound and are quadratic
...
Apache Thrift: Lua `THttpTransport:_parseHeaders` matches each header line with a backtracking pattern (quadratic)
...
Apache Thrift: Erlang generated struct reads have no recursion-depth guard (unbounded memory)
...
Apache Thrift: PHP `thrift_protocol` accelerator dereferences a missing container-element spec
...
Apache Thrift: Java TSaslNonblockingServer pre-auth unbounded SASL frame allocation
...
Apache Thrift: c_glib generated struct readers have no recursion-depth guard (native stack exhaustion)
...
Apache Thrift: PHP `TSimpleServer` exits the whole process on any non-transport exception
...
Apache Thrift: Lua `TFramedTransport`/`THttpTransport` re-slice the buffer on every read (quadratic)
...
Apache Thrift: Java `TSaslNonblockingServer` `Computation.run` orphans a connection on a pre-auth parse error
...
net: lan743x: fix RX checksum use-after-free
...
Apache Thrift: c_glib multiplexed processor crashes on a message it cannot route
...
seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation
...
Apache Thrift: PHP `TJSONProtocol` string/number readers have no size bound
...
selinux: preserve user SID across nested backing files
...
Apache Thrift: javame `TJsonProtocol`/`TJSONProtocol` has no string size bound
...
net: bridge: mst: move switchdev call outside rcu
...
Apache Thrift: Dart `TBinaryProtocol.readMessageBegin` allocates from the pre-versioned name length
...
drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc
...
Apache Thrift: Buffered transport reads are not accounted against MaxMessageSize
...
ALSA: core: Fix potential UAF after asynchronous card release
...
Apache Thrift: An exception escaping a libevent callback stops the D library's non-blocking server, allowing an unauthenticated remote attacker to deny service
...
wifi: cfg80211: ibss: ref BSS entry for joined event
...
Apache Thrift: php `--gen php:inlined` struct readers (and `TProtocol::skipBinary`) have no recursion-depth guard
...
wifi: mac80211: only operate on TDLS peers in the TDLS code
...
Apache Thrift: PHP `thrift_protocol` C extension ignores the configured `maxStringSize`
...
dmaengine: Fix device kref underflow in dma_chan_put()
...
Apache Thrift: PHP framed/memory/HTTP transports re-slice the buffer on every read (quadratic)
...
wifi: mac80211: mesh: reset the CSA state when leaving
...
Apache Thrift: A truncated HTTP request stops the D library's server, allowing an unauthenticated remote attacker to deny service
...
mmc: mxcmmc: cancel data work and watchdog on remove
...
Apache Thrift: c_glib read_message_begin leaves output parameters unset for non-versioned messages
...
btrfs: handle lack of space when cleaning up verity items
...
Apache Thrift: Java `TSaslNonblockingServer`: residual of CVE-2026-61373 (thread-death black hole + no cross-connection budget)
...
mmc: sdio_uart: fix xmit_fifo leak when the port table is full
...