Search CVE reports
41 – 50 of 38862 results
Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encode_punycode. The XS backend builds the encoded label in the string buffer of the scalar it returns,...
1 affected package
libnet-idn-encode-perl
| Package | 26.04 LTS |
|---|---|
| libnet-idn-encode-perl | Not affected |
Not in release
Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/http_headers.go uses protectHeaders for a hardcoded set of forwarded headers but omits the...
1 affected package
consul
| Package | 26.04 LTS |
|---|---|
| consul | Not in release |
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then...
1 affected package
dasel
| Package | 26.04 LTS |
|---|---|
| dasel | Needs evaluation |
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.1, parsing/json/json_reader.go decodeValue, decodeObject, and decodeArray, and parsing/xml/reader.go...
1 affected package
dasel
| Package | 26.04 LTS |
|---|---|
| dasel | Needs evaluation |
nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.35.1 patches...
1 affected package
nginx
| Package | 26.04 LTS |
|---|---|
| nginx | Not affected |
nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and...
1 affected package
nginx
| Package | 26.04 LTS |
|---|---|
| nginx | Not affected |
nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, `POST /api/users/onboarding/finish` is registered as anonymous (unauthenticated) and creates a user with full ReadWrite admin permissions....
1 affected package
nginx
| Package | 26.04 LTS |
|---|---|
| nginx | Not affected |
The CompressionFilter class uses ZLib to deflate and inflate data sent and received. When we inflate incoming data, the filter does not control the resulting size, and create a buffer no matter what. Some compressed data may have...
2 affected packages
mina, mina2
| Package | 26.04 LTS |
|---|---|
| mina | Not in release |
| mina2 | Needs evaluation |
getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media...
1 affected package
php-getid3
| Package | 26.04 LTS |
|---|---|
| php-getid3 | Needs evaluation |
getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject...
1 affected package
php-getid3
| Package | 26.04 LTS |
|---|---|
| php-getid3 | Needs evaluation |