Lucene search
+L
UbuntucveRecent

75910 matches found

UbuntuCve
UbuntuCve
•added 2026/07/14 8:17 p.m.•23 views

CVE-2026-48760

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlSanitizer::parse rejected raw BiDi formatting characters but not percent-encoded forms and used an ASCII-only whitespace check, allowing sanitized URLs...

6.1CVSS6.1AI score0.00338EPSS
SaveExploits0References3
UbuntuCve
UbuntuCve
•added 2026/07/14 8:17 p.m.•15 views

CVE-2026-45068

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, SendmailTransport in -t mode appended recipient addresses to the sendmail command line without a -- end-of-options separator, allowing an address beginnin...

8.7CVSS6.1AI score0.00524EPSS
SaveExploits0References2
UbuntuCve
UbuntuCve
•added 2026/07/14 8:17 p.m.•9 views

CVE-2026-47212

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, TwilioRequestParser::doParse received the configured webhook secret but ignored the X-Twilio-Signature HMAC header, allowing unauthenticated POST requests to inje...

6.9CVSS6.1AI score0.00267EPSS
SaveExploits0References2
UbuntuCve
UbuntuCve
•added 2026/07/14 8:17 p.m.•24 views

CVE-2026-47423

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. In 3.4.4, DOMPurify allowed selectedcontent by default, allowing browsers to re-clone an XSS payload after sanitization so that unsanitized markup inside is returned. This issue is fixed in version 3.4.5...

8.2CVSS6AI score0.0041EPSS
SaveExploits1References4
UbuntuCve
UbuntuCve
•added 2026/07/14 8:17 p.m.•17 views

CVE-2026-45071

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Crawler::addXmlContent set DOMDocument::$validateOnParse = true before loadXML, re-enabling external entity resolution and allowing attacker-supplied XML ...

8.7CVSS6.1AI score0.0057EPSS
SaveExploits0References2
UbuntuCve
UbuntuCve
•added 2026/07/14 8:17 p.m.•24 views

CVE-2026-48489

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, DefaultAuthenticationFailureHandler honored the request-supplied failurepath parameter when failureforward: true was enabled, allowing an unauthenticated...

8.7CVSS6.1AI score0.00596EPSS
SaveExploits0References3
UbuntuCve
UbuntuCve
•added 2026/07/14 8:17 p.m.•22 views

CVE-2026-47737

Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when setremoteaddress proxyprotocol: :v1 is enabled and persistent connections are used because Puma incorrectly re-parses PROXY protocol headers after each keep-alive...

7.5CVSS6.1AI score0.00266EPSS
SaveExploits0References8
UbuntuCve
UbuntuCve
•added 2026/07/14 8:17 p.m.•28 views

CVE-2026-50524

Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network...

7.5CVSS5.8AI score0.00634EPSS
SaveExploits0References5
UbuntuCve
UbuntuCve
•added 2026/07/14 8:17 p.m.•19 views

CVE-2026-50648

Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attacker to deny service over a network...

7.5CVSS7AI score0.0084EPSS
SaveExploits0References5
UbuntuCve
UbuntuCve
•added 2026/07/14 8:17 p.m.•23 views

CVE-2026-50525

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network...

7.5CVSS5.8AI score0.00604EPSS
SaveExploits0References5
UbuntuCve
UbuntuCve
•added 2026/07/14 8:17 p.m.•26 views

CVE-2026-48761

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlAttributeSanitizer::getSupportedAttributes omitted URL-bearing attributes on , , , and , and URLs inside content bypassed URL sanitization, allowing...

6.1CVSS6.1AI score0.00345EPSS
SaveExploits0References3
UbuntuCve
UbuntuCve
•added 2026/07/14 8:16 p.m.•25 views

CVE-2026-15709

A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop inflate processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via...

7.5CVSS6.1AI score0.00784EPSS
SaveExploits0References4
UbuntuCve
UbuntuCve
•added 2026/07/14 8:16 p.m.•25 views

CVE-2026-15714

An out-of-bounds read vulnerability was found in libsoup's multipart processing subsystem. The flaw exists in the soupmultipartinputstreamreadheaders function inside soup-multipart-input-stream.c, which does not adequately restrict or validate the size of incoming multipart boundary strings. When...

6.5CVSS6.1AI score0.00706EPSS
SaveExploits0References4
UbuntuCve
UbuntuCve
•added 2026/07/14 8:16 p.m.•21 views

CVE-2026-15713

A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under specific stream termination conditions, such as when an HTTP/2 connection encounters window exhaustion or explicit stream resets. A remote, unauthenticated...

5.9CVSS6.1AI score0.00563EPSS
SaveExploits0References4
UbuntuCve
UbuntuCve
•added 2026/07/14 8:16 p.m.•20 views

CVE-2026-15711

A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 §5.5, which mandates that all WebSocket control frames e.g., PING, PONG, CLOSE contain a payload of 125 bytes or less. A remote, unauthenticated attacker...

7.5CVSS6.1AI score0.00431EPSS
SaveExploits0References4
UbuntuCve
UbuntuCve
•added 2026/07/14 7:17 p.m.•12 views

CVE-2026-45754

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, the Mailjet mailer bridge and LOX24 notifier bridge webhook parsers received configured webhook secrets but did not verify them, allowing unauthenticated POST...

6.9CVSS6.1AI score0.00445EPSS
SaveExploits0References2
UbuntuCve
UbuntuCve
•added 2026/07/14 7:17 p.m.•18 views

CVE-2026-45753

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlAttributeSanitizer::getSupportedAttributes omits URL-valued attributes including action, formaction, poster, and cite, so configurations that adm...

6.1CVSS6.1AI score0.00338EPSS
SaveExploits0References2
UbuntuCve
UbuntuCve
•added 2026/07/14 7:17 p.m.•20 views

CVE-2026-45069

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, OidcTokenHandler::verifyClaims registered audience aud, issuer iss, and expiry exp checkers but did not pass the mandatory claims list to...

9.1CVSS6.1AI score0.00258EPSS
SaveExploits0References2
UbuntuCve
UbuntuCve
•added 2026/07/14 7:17 p.m.•26 views

CVE-2026-47303

Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network...

8.8CVSS5.8AI score0.00736EPSS
SaveExploits0References5
UbuntuCve
UbuntuCve
•added 2026/07/14 7:17 p.m.•13 views

CVE-2026-45755

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, MailtrapRequestParser::doParse received the configured webhook secret but ignored the X-Mt-Signature HMAC header, allowing unauthenticated POST requests to inject forged...

6.9CVSS6.1AI score0.00267EPSS
SaveExploits0References2
UbuntuCve
UbuntuCve
•added 2026/07/14 7:17 p.m.•17 views

CVE-2026-45305

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Yaml\Parser::cleanup used regular expressions with overlapping quantifiers for YAML directive, comment, and document marker cleanup,...

8.7CVSS6.1AI score0.00684EPSS
SaveExploits0References2
UbuntuCve
UbuntuCve
•added 2026/07/14 7:17 p.m.•13 views

CVE-2026-45075

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, method-scoped IsGranted, IsSignatureValid, and IsCsrfTokenValid attributes can be configured for GET only, but Symfony routes HEAD requests to the GET handler while the...

8.3CVSS6.2AI score0.00429EPSS
SaveExploits0References2
UbuntuCve
UbuntuCve
•added 2026/07/14 7:17 p.m.•12 views

CVE-2026-45072

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.4.24 until 6.4.40, 7.4.12, and 8.0.12, the development profiler fileexcerpt Twig filter escapes PHP files through highlightstring but interpolates lines from non-PHP files directly into...

5.4CVSS6.1AI score0.00305EPSS
SaveExploits0References2
UbuntuCve
UbuntuCve
•added 2026/07/14 7:17 p.m.•16 views

CVE-2026-45133

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, when the parser is exposed to attacker-controlled input, deeply nested mappings or sequences cause both the block-level Parser::parseBlock and inline...

8.2CVSS6.1AI score0.0063EPSS
SaveExploits0References2
UbuntuCve
UbuntuCve
•added 2026/07/14 7:17 p.m.•26 views

CVE-2026-47304

Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network...

9.8CVSS5.8AI score0.00216EPSS
SaveExploits0References5
UbuntuCve
UbuntuCve
•added 2026/07/14 7:17 p.m.•28 views

CVE-2026-47300

Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network...

8.8CVSS5.8AI score0.00527EPSS
SaveExploits0References5
UbuntuCve
UbuntuCve
•added 2026/07/14 7:17 p.m.•19 views

CVE-2026-47767

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.46 until 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the CVE-2024-50340 fix gated runtime argv parsing on empty$GET, but parsestr and the web SAPI can disagree, allowing a crafted query string to...

9.8CVSS6.1AI score0.00721EPSS
SaveExploits0References7
UbuntuCve
UbuntuCve
•added 2026/07/14 7:17 p.m.•26 views

CVE-2026-47302

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network...

7.5CVSS5.8AI score0.01029EPSS
SaveExploits0References5
UbuntuCve
UbuntuCve
•added 2026/07/14 7:17 p.m.•13 views

CVE-2026-45304

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Yaml\Parser resolved YAML collection aliases recursively, allowing a small untrusted YAML input to expand into a multi-gigabyte structur...

8.7CVSS6.1AI score0.00684EPSS
SaveExploits0References2
UbuntuCve
UbuntuCve
•added 2026/07/14 7:17 p.m.•14 views

CVE-2026-45064

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlSanitizer::parse passes Unicode explicit-direction BiDi formatting characters through into sanitized href and src attributes, allowing sanitized...

6.1CVSS6.1AI score0.00338EPSS
SaveExploits0References2
UbuntuCve
UbuntuCve
•added 2026/07/14 7:17 p.m.•12 views

CVE-2026-45070

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Mime\Header\ParameterizedHeader validates and encodes parameter values but emits parameter names verbatim, allowing a caller that derive...

6.5CVSS6.1AI score0.0039EPSS
SaveExploits0References2
UbuntuCve
UbuntuCve
•added 2026/07/14 7:17 p.m.•11 views

CVE-2026-45063

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, X509Authenticator extracts the user identifier from $SERVER'SSLCLIENTSDN' with an unanchored regex that matches emailAddress= anywhere in the distinguishe...

9.1CVSS6.1AI score0.00367EPSS
SaveExploits0References2
UbuntuCve
UbuntuCve
•added 2026/07/14 7:17 p.m.•11 views

CVE-2026-45073

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, PdoAdapter::doClear builds a DELETE statement using a namespace derived from the caller-supplied $prefix without binding or escaping it, allowing a caller...

7.3CVSS6.1AI score0.00458EPSS
SaveExploits0References2
UbuntuCve
UbuntuCve
•added 2026/07/14 7:16 p.m.•23 views

CVE-2026-15712

A heap buffer over-read vulnerability was discovered in libsoup's versions: libsoup 3.0 to 3.7.0 HTTP/2 connection tracking framework. When the library processes an HTTP/2 GOAWAY frame, it improperly handles the "Additional Debug Data" payload by assuming the data stream is a safely NUL-terminate...

5.9CVSS6.1AI score0.0066EPSS
SaveExploits0References4
UbuntuCve
UbuntuCve
•added 2026/07/14 6:18 p.m.•22 views

CVE-2026-57108

Access of resource using incompatible type 'type confusion' in .NET Core allows an unauthorized attacker to deny service over a network...

7.5CVSS5.8AI score0.01105EPSS
SaveExploits0References5
UbuntuCve
UbuntuCve
•added 2026/07/14 6:17 p.m.•13 views

CVE-2026-45074

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.1.0 until 7.4.12 and 8.0.12, Cas2Handler builds the CAS service parameter from Request::getSchemeAndHttpHost, which reflects an attacker-controlled Host header when framework.trustedhosts is n...

8.1CVSS6.1AI score0.00488EPSS
SaveExploits0References2
UbuntuCve
UbuntuCve
•added 2026/07/14 6:17 p.m.•12 views

CVE-2026-45067

Description Symfony\Component\Mime\Address is the value-object every Symfony Mailer address to/cc/bcc/from/reply-to flows through; its constructor is documented as validating the address and throwing on invalid input, so developers treat it as a security boundary. The constructor accepts email...

6.3CVSS6.1AI score0.00598EPSS
SaveExploits0References2
UbuntuCve
UbuntuCve
•added 2026/07/14 6:17 p.m.•12 views

CVE-2026-45756

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.3.0-BETA1 until 7.4.12 and 8.0.12, the JsonPath component compiles attacker-controlled match and search filter patterns directly into pregmatch without a length cap, i-regexp restriction, or...

8.2CVSS6.1AI score0.0063EPSS
SaveExploits0References2
UbuntuCve
UbuntuCve
•added 2026/07/14 6:17 p.m.•17 views

CVE-2026-45065

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, UrlGenerator validates route parameters against a pattern built as ^ plus the raw requirement plus $; with ungrouped alternations, middle alternatives mat...

6.1CVSS6.1AI score0.00348EPSS
SaveExploits0References2
UbuntuCve
UbuntuCve
•added 2026/07/14 6:17 p.m.•18 views

CVE-2026-15747

Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle. csrftoken generates and caches one token per session and returns the same value on every call, and csrffield places that value in a hidden csrftoken input...

9.1CVSS6.1AI score0.00255EPSS
SaveExploits0References5
UbuntuCve
UbuntuCve
•added 2026/07/14 6:17 p.m.•16 views

CVE-2026-45066

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, HtmlSanitizer URL sanitization can allow off-allowlist URLs through allowLinkHosts or allowMediaHosts because UrlSanitizer::parse follows RFC 3986...

6.1CVSS6.1AI score0.00338EPSS
SaveExploits0References2
UbuntuCve
UbuntuCve
•added 2026/07/14 6:17 p.m.•12 views

CVE-2026-45077

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the server:log listener Symfony\Bridge\Monolog\Command\ServerLogCommand binds to 0.0.0.0:9911 by default and processes each received frame with...

8.6CVSS6.1AI score0.00666EPSS
SaveExploits0References2
UbuntuCve
UbuntuCve
•added 2026/07/14 5:17 p.m.•25 views

CVE-2026-54433

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting XSS via a crafted plain-text email message. The attacker-controlled JavaScript executes within the victim's authenticated session simply by opening or previewing the message zero-click...

10CVSS6.1AI score0.00311EPSS
SaveExploits1References2
UbuntuCve
UbuntuCve
•added 2026/07/14 5:17 p.m.•23 views

CVE-2026-59197

Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter calls image.expandsize // 2, size // 2 before rank-filter size validation and...

8.2CVSS6.1AI score0.00445EPSS
SaveExploits1References5
UbuntuCve
UbuntuCve
•added 2026/07/14 5:17 p.m.•22 views

CVE-2026-59888

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector.removeUnwantedIgnorals records an...

6.5CVSS6.1AI score0.00309EPSS
SaveExploits0References5
UbuntuCve
UbuntuCve
•added 2026/07/14 5:17 p.m.•22 views

CVE-2026-59200

Pillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode in PIL/PdfParser.py calls zlib.decompress with bufsize set to the PDF stream Length field without bounding the decompressed output size, allowing a crafted FlateDecode PDF stream to exhaust memory from a small...

7.5CVSS6.1AI score0.00385EPSS
SaveExploits1References5
UbuntuCve
UbuntuCve
•added 2026/07/14 5:17 p.m.•27 views

CVE-2026-59884

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with C...

7.5CVSS6.1AI score0.00349EPSS
SaveExploits0References4
UbuntuCve
UbuntuCve
•added 2026/07/14 5:17 p.m.•18 views

CVE-2026-59885

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode call and c...

7.5CVSS6.1AI score0.00335EPSS
SaveExploits0References3
UbuntuCve
UbuntuCve
•added 2026/07/14 5:17 p.m.•21 views

CVE-2026-59886

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float...

7.5CVSS6.1AI score0.00335EPSS
SaveExploits0References4
UbuntuCve
UbuntuCve
•added 2026/07/14 5:17 p.m.•23 views

CVE-2026-54432

Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting XSS. The issue occurs because the attachment MIME type is not properly escaped on the attachment-validation warning page...

4.7CVSS6.1AI score0.00206EPSS
SaveExploits0References2
Total number of security vulnerabilities75910