133001 matches found
Important: Red Hat Security Advisory: kernel security update
An update for kernel is now available for NVIDIA for RHEL 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...
kernel: xfrm: ah6: validate routing header segments_left
A flaw was found in the Linux kernel's xfrm subsystem, specifically within the AH6 Authentication Header for IPv6 module. The ipv6rearrangerthdr function does not properly validate the segmentsleft field in routing headers when processing raw IPv6 HDRINCL packets. This oversight allows an attacke...
freerdp: FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass
A flaw was found in FreeRDP server. This vulnerability allows unauthenticated attackers to bypass server policies that disable Remote Desktop Services over Transport Layer Security RDSTLS connections. By sending incompatible protocol requests and then completing a TLS handshake, attackers can...
Critical: Red Hat Security Advisory: freerdp security update
An update for freerdp is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...
pcre2: pcre2: Out-of-bounds write via crafted regular expression
A flaw was found in pcre2. When an application processes attacker-controlled regular expressions using certain Just-In-Time JIT compiler interfaces, an out-of-bounds write with arbitrary data can occur. An attacker could exploit this vulnerability to achieve arbitrary code execution, corrupt...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: pcre2: pcre2-10.49-0.1.hum1 aarch64, x8664 pcre2-devel-10.49-0.1.hum1 aarch64, x8664 pcre2-static-10.49-0.1.hum1 aarch64, x8664 pcre2-syntax-10.49-0.1.hum1 noarch pcre2-tools-10.49-0.1.hum1...
Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: freetype: freetype-2.14.3-2.1.hum1 aarch64, x8664 freetype-demos-2.14.3-2.1.hum1 aarch64, x8664 freetype-devel-2.14.3-2.1.hum1 aarch64, x8664 freetype-2.14.3-2.1.hum1.src src Security Fixes:...
freetype: FreeType: Denial of Service via repeated subroutine allocations in CID font loader
A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerability by tricking a user into opening content that embeds or references a specially crafted CID-keyed font. This crafted font can cause repeated allocations and decryptions of...
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration
A flaw was found in OpenTelemetry-Go, specifically within its gRPC log exporter. This vulnerability allows a network attacker to bypass the intended private Certificate Authority CA pinning and mutual Transport Layer Security TLS configurations. The issue arises because the environment-only TLS...
Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: opentofu1.12: opentofu1.12-1.12.7-0.1.hum1 aarch64, x8664 opentofu1.12-1.12.7-0.1.hum1.src src Security Fixes: opentofu1.12: CVE-2026-81871...
Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: python3.12: python3.12-3.12.15-1.hum1 aarch64, x8664 python3.12-debug-3.12.15-1.hum1 aarch64, x8664 python3.12-devel-3.12.15-1.hum1 aarch64, x8664 python3.12-idle-3.12.15-1.hum1 aarch64, x8664...
python: python: Arbitrary file deletion via race condition during temporary directory cleanup
A flaw was found in Python. A race condition during the cleanup of temporary directories allows a local attacker with write access to replace a directory with a symbolic link a reference pointing to another location. This can lead to unauthorized deletion or alteration of files outside the...
Important: Red Hat Security Advisory: ruby security update
An update for ruby is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...
resolv: resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses
A flaw was found in the resolv gem. An attacker controlling DNS responses e.g., a spoofed response or a malicious upstream DNS server can exploit this by sending crafted DNS responses containing many distinct unknown DNS resource record pairs or SvcParamKeys. This leads to uncontrolled memory...
axios: Axios: Server-Side Request Forgery via bypassed redirect restrictions in fetch adapter
A flaw was found in Axios. When configured to use the fetch adapter, the application does not enforce settings configured to disable HTTP redirects. A remote attacker controlling a redirecting server can exploit this behavior to force the application to follow redirects to internal endpoints,...
axios: Axios: Outbound HTTP header injection via prototype pollution in fetch adapter
A flaw was found in Axios. This vulnerability allows an attacker to manipulate outbound network traffic by injecting arbitrary HTTP Hypertext Transfer Protocol headers. In environments where an attacker can exploit a separate prototype pollution flaw to modify shared object properties, the Axios...
axios: axios: Denial of Service via prototype pollution gadget in form serialization
A flaw was found in axios. In applications affected by prototype pollution, where an attacker can modify base JavaScript object properties, axios processes inherited options during form data serialization without verifying property ownership. An attacker can leverage this behavior to trigger a...
axios: axios: Unintended HTTP method override via prototype pollution gadget
A flaw was found in axios. When sending HTTP requests that omit an explicit request method, Axios can inherit properties from the JavaScript prototype chain rather than using safe internal defaults. If an attacker manipulates shared object properties through a separate vulnerability in the same...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: grafana13.2: grafana13.2-13.2.1-0.9.hum1 aarch64, x8664 grafana13.2-13.2.1-0.9.hum1.src src Security Fixes: grafana13.2: CVE-2026-101903...
axios: Axios: Denial of Service via malformed data URLs
A flaw was found in Axios. A remote attacker can exploit this vulnerability by supplying a crafted data URL containing repeated slash characters to an application that processes untrusted inputs. Due to an inefficient regular expression used to parse the URL, handling the malformed input triggers...
axios: axios: Request socket hijacking via inherited createConnection property
A flaw was found in axios. When running in Node.js, the HTTP adapter does not define an explicit connection creation setting on outgoing request options. If a separate prototype-pollution flaw is exploited in the same process, an attacker can hijack the network socket by injecting a malicious...
axios: axios: Denial of Service via crafted redirect hostname
A flaw was found in axios. A remote attacker operating a malicious server can cause a Denial of Service DoS by returning an HTTP redirect containing a crafted hostname. When proxy bypass settings are configured, the application processes the hostname with an inefficient regular expression that...
axios: axios: Security control bypass via unapplied HTTP/2 proxy and DNS settings
A flaw was found in axios. When processing HTTP/2 requests, the client fails to enforce configured proxy settings and custom Domain Name System DNS resolution policies. A remote attacker who can influence destination URLs could exploit this vulnerability to bypass outbound network restrictions,...
axios: Axios: Denial of Service via unhandled error in HTTP/2 session initialization
A flaw was found in Axios. A remote attacker or an unresponsive endpoint can cause a Denial of Service DoS by triggering an error during HTTP/2 session initialization or reuse. Because the underlying session fails to register proper error handlers, network or session failures result in an uncaugh...
axios: Axios: Outbound HTTP request manipulation via fetch adapter prototype pollution
A flaw was found in Axios. When using the fetch adapter, Axios fails to properly isolate request configuration options from inherited object properties. If an attacker first exploits a separate prototype pollution vulnerability where shared JavaScript object properties are modified within the...
axios: Axios: HTTP header injection via inherited prototype properties
A flaw was found in Axios. If a separate vulnerability modifies shared object properties prototype pollution in the application environment, Axios may inherit those properties when processing request configurations rebuilt without explicit headers. An attacker can exploit this condition to inject...
axios: Axios: Denial of Service via malformed data URLs
A flaw was found in Axios. A remote attacker can exploit this vulnerability by supplying a crafted data URL containing repeated slash characters to an application that processes untrusted inputs. Due to an inefficient regular expression used to parse the URL, handling the malformed input triggers...
axios: Axios: HTTP header injection via inherited prototype properties
A flaw was found in Axios. If a separate vulnerability modifies shared object properties prototype pollution in the application environment, Axios may inherit those properties when processing request configurations rebuilt without explicit headers. An attacker can exploit this condition to inject...
axios: Axios: Server-Side Request Forgery via bypassed redirect restrictions in fetch adapter
A flaw was found in Axios. When configured to use the fetch adapter, the application does not enforce settings configured to disable HTTP redirects. A remote attacker controlling a redirecting server can exploit this behavior to force the application to follow redirects to internal endpoints,...
axios: axios: Request socket hijacking via inherited createConnection property
A flaw was found in axios. When running in Node.js, the HTTP adapter does not define an explicit connection creation setting on outgoing request options. If a separate prototype-pollution flaw is exploited in the same process, an attacker can hijack the network socket by injecting a malicious...
axios: axios: Unintended HTTP method override via prototype pollution gadget
A flaw was found in axios. When sending HTTP requests that omit an explicit request method, Axios can inherit properties from the JavaScript prototype chain rather than using safe internal defaults. If an attacker manipulates shared object properties through a separate vulnerability in the same...
axios: axios: Denial of Service via prototype pollution gadget in form serialization
A flaw was found in axios. In applications affected by prototype pollution, where an attacker can modify base JavaScript object properties, axios processes inherited options during form data serialization without verifying property ownership. An attacker can leverage this behavior to trigger a...
axios: Axios: Outbound HTTP header injection via prototype pollution in fetch adapter
A flaw was found in Axios. This vulnerability allows an attacker to manipulate outbound network traffic by injecting arbitrary HTTP Hypertext Transfer Protocol headers. In environments where an attacker can exploit a separate prototype pollution flaw to modify shared object properties, the Axios...
axios: Axios: Denial of Service via unhandled error in HTTP/2 session initialization
A flaw was found in Axios. A remote attacker or an unresponsive endpoint can cause a Denial of Service DoS by triggering an error during HTTP/2 session initialization or reuse. Because the underlying session fails to register proper error handlers, network or session failures result in an uncaugh...
axios: axios: Denial of Service via crafted redirect hostname
A flaw was found in axios. A remote attacker operating a malicious server can cause a Denial of Service DoS by returning an HTTP redirect containing a crafted hostname. When proxy bypass settings are configured, the application processes the hostname with an inefficient regular expression that...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: grafana12.4: grafana12.4-12.4.12-0.3.hum1 aarch64, x8664 grafana12.4-12.4.12-0.3.hum1.src src Security Fixes: grafana12.4: CVE-2026-101903 CVE-2026-93450...
axios: axios: Security control bypass via unapplied HTTP/2 proxy and DNS settings
A flaw was found in axios. When processing HTTP/2 requests, the client fails to enforce configured proxy settings and custom Domain Name System DNS resolution policies. A remote attacker who can influence destination URLs could exploit this vulnerability to bypass outbound network restrictions,...
axios: Axios: Outbound HTTP request manipulation via fetch adapter prototype pollution
A flaw was found in Axios. When using the fetch adapter, Axios fails to properly isolate request configuration options from inherited object properties. If an attacker first exploits a separate prototype pollution vulnerability where shared JavaScript object properties are modified within the...
axios: Axios: Outbound HTTP request manipulation via fetch adapter prototype pollution
A flaw was found in Axios. When using the fetch adapter, Axios fails to properly isolate request configuration options from inherited object properties. If an attacker first exploits a separate prototype pollution vulnerability where shared JavaScript object properties are modified within the...
axios: Axios: HTTP header injection via inherited prototype properties
A flaw was found in Axios. If a separate vulnerability modifies shared object properties prototype pollution in the application environment, Axios may inherit those properties when processing request configurations rebuilt without explicit headers. An attacker can exploit this condition to inject...
axios: Axios: Denial of Service via unhandled error in HTTP/2 session initialization
A flaw was found in Axios. A remote attacker or an unresponsive endpoint can cause a Denial of Service DoS by triggering an error during HTTP/2 session initialization or reuse. Because the underlying session fails to register proper error handlers, network or session failures result in an uncaugh...
axios: axios: Request socket hijacking via inherited createConnection property
A flaw was found in axios. When running in Node.js, the HTTP adapter does not define an explicit connection creation setting on outgoing request options. If a separate prototype-pollution flaw is exploited in the same process, an attacker can hijack the network socket by injecting a malicious...
axios: Axios: Server-Side Request Forgery via bypassed redirect restrictions in fetch adapter
A flaw was found in Axios. When configured to use the fetch adapter, the application does not enforce settings configured to disable HTTP redirects. A remote attacker controlling a redirecting server can exploit this behavior to force the application to follow redirects to internal endpoints,...
axios: axios: Security control bypass via unapplied HTTP/2 proxy and DNS settings
A flaw was found in axios. When processing HTTP/2 requests, the client fails to enforce configured proxy settings and custom Domain Name System DNS resolution policies. A remote attacker who can influence destination URLs could exploit this vulnerability to bypass outbound network restrictions,...
axios: Axios: Denial of Service via malformed data URLs
A flaw was found in Axios. A remote attacker can exploit this vulnerability by supplying a crafted data URL containing repeated slash characters to an application that processes untrusted inputs. Due to an inefficient regular expression used to parse the URL, handling the malformed input triggers...
axios: axios: Denial of Service via prototype pollution gadget in form serialization
A flaw was found in axios. In applications affected by prototype pollution, where an attacker can modify base JavaScript object properties, axios processes inherited options during form data serialization without verifying property ownership. An attacker can leverage this behavior to trigger a...
hono: hono/jsx: Cross-Site Scripting via Unescaped Strings
A flaw was found in hono/jsx. This vulnerability occurs because the software fails to properly escape plain strings when they are rendered in certain contexts during server-side rendering. A remote attacker can exploit this by providing specially crafted input, leading to Cross-Site Scripting XSS...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: grafana13.1: grafana13.1-13.1.6-0.6.hum1 aarch64, x8664 grafana13.1-13.1.6-0.6.hum1.src src Security Fixes: grafana13.1: CVE-2026-101903 CVE-2026-93981...
axios: axios: Unintended HTTP method override via prototype pollution gadget
A flaw was found in axios. When sending HTTP requests that omit an explicit request method, Axios can inherit properties from the JavaScript prototype chain rather than using safe internal defaults. If an attacker manipulates shared object properties through a separate vulnerability in the same...
axios: Axios: Outbound HTTP header injection via prototype pollution in fetch adapter
A flaw was found in Axios. This vulnerability allows an attacker to manipulate outbound network traffic by injecting arbitrary HTTP Hypertext Transfer Protocol headers. In environments where an attacker can exploit a separate prototype pollution flaw to modify shared object properties, the Axios...