Export limit exceeded: 377350 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (377350 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-18725 | 1 Open-iscsi Project | 1 Open-iscsi | 2026-08-13 | 6.3 Medium |
| AI_ONLY_REPORT package: iscsi-initiator-utils-6.2.1.11-0.git4b3e853.el10 ------ Summary: Out-of-Bounds Write and Information Disclosure via Unvalidated IPv6 Payload Length: crafted ICMPv6 Echo Requests can cause `iscsiuio` to trust an inflated `ipv6_plen` larger than the actual received payload, leading to MTU-bounded out-of-bounds reads and a potential one-byte out-of-bounds write that may disclose data beyond the valid packet boundary. Requirements to exploit: Adjacent-network access on the same L2 segment as a system running `iscsiuio` on an interface that processes IPv6/NDP traffic, plus the ability to send a crafted ICMPv6 Echo Request with a forged `IPv6.plen`. No authentication or user interaction is required. Component affected: `iscsi-initiator-utils` (`iscsiuio`): `iscsiuio/src/uip/ipv6.c` in `ipv6_icmp_handle_echo_request()` and `ipv6_insert_protocol_chksum()`. Version affected: `iscsi-initiator-utils-6.2.1.11-0.git4b3e853.el10` when `iscsiuio` is processing IPv6/NDP traffic on a reachable interface. Patch available: no released package fix established; proposed patch included below Version fixed: unknown Upstream coordination: Not notified. CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - 6.3 (MEDIUM) AV:A - Reachability is limited to an attacker on the same L2 segment who can send crafted IPv6/ICMPv6 traffic to the affected interface. AC:L - The attack relies on forging `IPv6.plen`; no race or unusual environment is needed beyond the vulnerable deployment. PR:N - No privileges are required. UI:N - No user interaction is required. S:U - The impact remains within the `iscsiuio` process and its packet buffer handling. C:L - The reply/checksum path can read and potentially transmit data beyond the valid packet boundary, but the demonstrated exposure is MTU-bounded. I:L - For odd forged lengths, the checksum path can write a single padding byte past the valid protocol data, which may affect adjacent buffer contents. A:L - Invalid memory access may destabilize or crash the process, but reliable high-impact denial of service is not established from the available evidence. Impact: Moderate. Under Red Hat's severity guidance, this is more consistent with a flaw that can affect confidentiality, integrity, or availability under constrained circumstances than with an Important issue. The bug is unauthenticated and adjacent-network reachable, but the currently supported outcome is MTU-bounded out-of-bounds access in a deployment-dependent IPv6/NDP path, not easy remote system compromise or clearly high-impact memory corruption. Embargo: no Reason: The currently supported impact is Moderate, exposure depends on `iscsiuio` processing IPv6 traffic on a reachable L2 segment, and operators can reduce exposure operationally by isolating or disabling the affected path. Acknowledgement: Aisle Research Vulnerability Details: In the ICMPv6 echo-reply path, the code reuses the inbound `ipv6_plen` field when sizing the reply instead of clamping it to the bytes actually received: ```c /* iscsiuio/src/uip/ipv6.c */ static void ipv6_icmp_handle_echo_request(struct ipv6_context *context) { ... ipv6_send(context, (u8_t *) icmp - (u8_t *) eth + sizeof(struct ipv6_hdr) + HOST_TO_NET16(ipv6->ipv6_plen)); } ``` Later, checksum generation also trusts `ipv6_plen` for memory traversal, and for odd lengths it writes a padding byte at `ptr + protocol_data_len` before iterating over `protocol_data_len` bytes: ```c /* iscsiuio/src/uip/ipv6.c */ protocol_data_len = HOST_TO_NET16(ipv6->ipv6_plen); ... if (protocol_data_len & 1) { *((u8_t *) ptr + protocol_data_len) = 0; protocol_data_len++; } for (i = 0; i < protocol_data_len / 2; i++) { sum += HOST_TO_NET16(*ptr); ptr++; } ``` The available receive-side logic does not establish a payload-length bound strong enough to eliminate this condition. `uip_input()` compares the IPv6 payload length against `uip_len`, but `uip_len` is treated as full frame length in the observed path rather than the actual IPv6 payload length, and `ipv6_rx_packet()` receives a `len` argument without using it to bound parsing. A forged `ipv6_plen` can therefore exceed the real IPv6 payload stored in the buffer. The available evidence supports MTU-bounded out-of-bounds access in normal receive paths rather than the earlier arbitrary 64KB worst case. The affected logic appears to be present in the available 6.2.1.11 code base, but this report is scoped to the scanned SRPM package. Steps to reproduce: 1. Build `iscsiuio` with ASAN enabled. 2. Run `iscsiuio` with IPv6/NDP active on a test interface. 3. From the same L2 segment, send an ICMPv6 Echo Request with `IPv6.plen` set larger than the actual payload bytes in the frame buffer; one tested shape is `plen=1491` with an Ethernet frame size near 1500 bytes. 4. Observe the reply path: ASAN reports invalid access in `ipv6_insert_protocol_chksum()` as the checksum walk reads past valid packet data, odd lengths may also trigger a one-byte write, and reply sizing is derived from the forged `ipv6_plen` rather than the actual received payload size. Mitigation: Until a fix is available, keep `iscsiuio`-managed interfaces on trusted L2 segments only. Where operationally acceptable, disable IPv6 on those interfaces or filter ICMPv6 Echo Requests before they reach `iscsiuio`. If `iscsiuio` is not processing IPv6/NDP traffic, this specific path is not reachable. Proposed Fix: Clamp the reply payload length to the actual received payload derived from `context->ustack->uip_len`, reject packets too short to contain a complete ICMPv6 header, and rewrite `ipv6->ipv6_plen` before calling `ipv6_send()`. ```diff diff --git a/iscsiuio/src/uip/ipv6.c b/iscsiuio/src/uip/ipv6.c @@ -1100,6 +1100,8 @@ static void ipv6_icmp_handle_echo_request(struct ipv6_context *context) { struct eth_hdr *eth = (struct eth_hdr *)context->ustack->data_link_layer; +u16_t rx_total, rx_payload, hdr_plen, safe_plen; +u16_t l2_l3_len = sizeof(struct eth_hdr) + sizeof(struct ipv6_hdr); struct ipv6_hdr *ipv6 = (struct ipv6_hdr *)context->ustack->network_layer; struct icmpv6_hdr *icmp = (struct icmpv6_hdr *)((u8_t *)ipv6 + @@ -1126,8 +1128,20 @@ static void ipv6_icmp_handle_echo_request(struct ipv6_context *context) icmp->icmpv6_code = 0; icmp->icmpv6_cksum = 0; ILOG_DEBUG("IPv6: Send echo reply"); -ipv6_send(context, (u8_t *) icmp - (u8_t *) eth + sizeof(struct ipv6_hdr) + HOST_TO_NET16(ipv6>ipv6_plen)); + +rx_total = context->ustack->uip_len; +if (rx_total <= l2_l3_len) +return; + +rx_payload = rx_total - l2_l3_len; +hdr_plen = HOST_TO_NET16(ipv6->ipv6_plen); +safe_plen = (hdr_plen <= rx_payload) ? hdr_plen : rx_payload; +if (safe_plen < sizeof(struct icmpv6_hdr)) +return; + +ipv6->ipv6_plen = HOST_TO_NET16(safe_plen); +ipv6_send(context, l2_l3_len + safe_plen); + return; } ``` ------ This report was generated using AI technology. Always review AI-generated content prior to use | ||||
| CVE-2026-7366 | 1 Ibm | 3 Datapower Gateway 1050, Datapower Gateway 1060, Datapower Gateway 1100 | 2026-08-13 | 4.2 Medium |
| IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0.21 and IBM DataPower Gateway 10.6.0.0 through 10.6.0.9 allows a race condition that results in improper isolation of request state when handling the built‑in X‑Client‑IP header. Under concurrent request processing, X‑Client‑IP values may be contaminated across requests, enabling IP spoofing and disclosure of other clients’ IP addresses. | ||||
| CVE-2026-73626 | 1 Jupyter | 1 Jupyterlab | 2026-08-13 | 0 Low |
| JupyterLab versions >=4.6.0,<=4.6.1 and <=4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install(). A missing 'await' caused the is_install_allowed coroutine to never execute, so the extension allowlist/blocklist check was not enforced for direct callers of install(). The stock JupyterLab HTTP API and Extension Manager UI are not affected, as they perform a separate, correctly awaited check. The issue affects only deployments where a custom extension or downstream integration imports PyPIExtensionManager and calls install() directly with a package name influenced by untrusted input, an allowlist/blocklist is configured, the PyPI Extension Manager is enabled, and kernels and terminals are disabled or delegated to remote hosts. Fixed in JupyterLab 4.6.2 and 4.5.10. | ||||
| CVE-2026-73618 | 1 Budibase | 1 Budibase | 2026-08-13 | 8.3 High |
| Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON metacharacters. Attackers with query write permission can inject JSON structural characters to alter MongoDB queries, bypassing filters to read, modify, or delete arbitrary documents. | ||||
| CVE-2026-73602 | 1 Flowiseai | 1 Flowise | 2026-08-13 | N/A |
| Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment locale validation bypass. Attackers can craft a fake String object with a match function that bypasses path traversal checks to load and execute malicious JavaScript files stored in the document store outside the sandbox. | ||||
| CVE-2026-73501 | 1 Getkin | 1 Kin-openapi | 2026-08-13 | 9.1 Critical |
| kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI security requirement to be satisfied for unauthenticated requests when an application relies on ValidationHandler as its enforcement middleware. The no-op callback prevents the fail-closed ErrAuthenticationServiceMissing path from being reached and forwards the request to protected handlers that may require an API key, OAuth token, or another security scheme. This issue is fixed in version 0.144.0. | ||||
| CVE-2026-73495 | 1 Http4s | 1 Blaze | 2026-08-13 | 7.4 High |
| blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and 1.0.0-M42, blaze-server can merge HTTP/1.1 chunked-body trailer fields into Request.headers. Because trailer fields are attacker-controlled, an unauthenticated remote client can inject arbitrary header names and values, including X-Forwarded-For and internal authorization headers, that a fronting proxy sanitized from the request-header section, bypassing header-based trust decisions in the application. Any http4s application using BlazeServerBuilder over HTTP/1.1 whose routes or middleware trust proxy-set headers, including X-Forwarded-For, X-Real-IP, and X-Forwarded-Host, is affected. If a fronting proxy strips or normalizes those headers but forwards chunked bodies with trailers intact, an attacker can spoof client IP for allow-lists, rate limits, or auditing, forge the https scheme, or inject internal authorization headers. A promoted Connection: close trailer is also honored, allowing attacker-controlled termination of pooled backend connections. This issue is fixed in versions 0.23.18 and 1.0.0-M42. | ||||
| CVE-2026-73486 | 1 Flowiseai | 1 Flowise | 2026-08-13 | N/A |
| Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's customReadCSV parameter that allows authenticated attackers to execute arbitrary Python code. The validator uses a static regex blocklist that can be bypassed through obfuscation techniques, enabling attackers to execute code in the unsandboxed pyodide environment with full system access. | ||||
| CVE-2026-73434 | 1 Redhat | 1 Enterprise Linux | 2026-08-13 | 6.1 Medium |
| A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp->fields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial of service). Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072). | ||||
| CVE-2026-73418 | 1 Nextauth.js | 2 Core, Next-auth | 2026-08-13 | 7.5 High |
| NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken() helper in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when it reads a malformed Authorization: Bearer header. When no session cookie is present, getToken() URL-decodes the bearer value before validating it, and malformed percent encoding causes decodeURIComponent() to throw instead of treating the token as invalid. Because getToken() is commonly called in API routes, middleware, and server-side request handlers, a single unauthenticated request can trigger an unhandled exception in code paths that authenticate requests, causing a per-request denial of service without exposing tokens, sessions, or other data and without bypassing authentication. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32. | ||||
| CVE-2026-73412 | 1 Ericcornelissen | 1 Shescape | 2026-08-13 | N/A |
| Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, this impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or true when the default shell is Zsh, using the escape and escapeAll. The Zsh options EXTENDED_GLOB and MAGIC_EQUAL_SUBST exacerbate the problem. In certain case, an attacker can leverage home directory expansion and extended glob syntax to obtain lists of files and directories on the system. Depending on what the command does, this may be used to leak more information. This issue is fixed in versions 2.1.14 and 3.0.1. | ||||
| CVE-2026-73306 | 1 Budibase | 1 Budibase | 2026-08-13 | 5.3 Medium |
| Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the failure counter in packages/worker/src/api/controllers/global/auth.ts only for existing users, while packages/worker/src/middleware/emailLockout.ts returned X-Account-Locked and Retry-After only for locked identifiers. An unauthenticated attacker could compare the response after repeated failures to enumerate valid email addresses and temporarily lock valid accounts. This issue is fixed in version 3.39.25. | ||||
| CVE-2026-72506 | 1 National Institute Of Information And Communications Technology | 1 Voicetra | 2026-08-13 | N/A |
| VoiceTra provided by National Institute of Information and Communications Technology (NICT) contains an incorrectly specified destination in a communication channel vulnerability. Users may be directed to a server (or service) controlled by an attacker, potentially resulting in the theft of input data or the display of incorrect results. | ||||
| CVE-2026-71471 | 1 Redhat | 2 Acm, Advanced Cluster Management For Kubernetes | 2026-08-13 | 9 Critical |
| A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster, specifically with patch access to the Search Custom Resource (CR), could exploit a vulnerability in the `Collector.ImageOverride` field. This allows the attacker to deploy an arbitrary container image across all managed clusters. The consequence is remote code execution (RCE), enabling the attacker to execute commands and potentially access sensitive information across the entire fleet of managed clusters. | ||||
| CVE-2026-6322 | 2 Fast-uri, Openjsf | 2 Fast-uri, Fast-uri | 2026-08-13 | 7.5 High |
| fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a different domain was re-emitted with the at-sign as a raw userinfo separator, changing the URI's authority to the second domain. Applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing can be steered to a different authority than the input appeared to specify. Versions <= 3.1.1 are affected. Update to 3.1.2 or later. | ||||
| CVE-2026-67587 | 1 Apache | 1 Airflow | 2026-08-13 | 8.8 High |
| Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because `SyncCallback` is itself an Airflow class it passes the default `allowed_deserialization_classes` allow-list, so tightening that setting does not help. A Dag author — who controls a task instance's `next_kwargs` through the task execution API — can therefore cause an arbitrary module to be imported inside the scheduler process, when the scheduler's `awaiting_input` timeout sweep deserializes that value. No non-default configuration is required; the sweep runs unconditionally. Versions before 3.3.0 are not affected: the class existed, but the scheduler sweep that reaches it did not. This is a separate code path from CVE-2026-58076 and CVE-2026-67260, which cover different gadgets reaching deserialization — applying either of those fixes does not address this one. Users are advised to upgrade to apache-airflow 3.3.1 or later. | ||||
| CVE-2026-67579 | 1 Ash-project | 1 Ash | 2026-08-13 | N/A |
| Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pagination cursor, resulting in SQL injection or code execution depending on the data layer. Read actions with keyset pagination decode the client-supplied page[:after] or page[:before] cursor in decode_values/2 in lib/ash/page/keyset.ex using non_executable_binary_to_term/2 with [:safe]. That guard blocks new atoms, funs, and ports, but not a struct built from atoms already interned in a running Ash application, so a decoded %Ash.Query.Call{} expression survives and is spliced into the keyset filter as a comparison value in do_filters/4 and evaluated. Because the cursor bypasses the Ash.Expr macro, the runtime never applies the private?/public? gate that would otherwise reject it. On AshPostgres the injected fragment is inlined into the SQL query; on the ETS and Simple data layers it is evaluated in-process as an arbitrary function call. This issue affects ash: from 1.17.0 before 3.31.3. | ||||
| CVE-2026-63294 | 1 Canonical | 1 Lxd | 2026-08-13 | 9.9 Critical |
| A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image or backup archives, LXD fails to properly validate and confine the backup.yaml file when it exists as a symbolic link. An attacker can exploit this flaw by providing a malicious archive with a symlinked backup.yaml file, causing LXD to process unconfined configuration metadata and execute arbitrary commands with root privileges. | ||||
| CVE-2026-63293 | 1 Canonical | 1 Lxd | 2026-08-13 | 9.9 Critical |
| A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symbolic link. An attacker can exploit this flaw by providing a crafted image archive with a symlinked metadata.yaml file pointing to target file paths on the host system. | ||||
| CVE-2026-8989 | 1 Autel | 2 Maxicharger Single Charger, Maxicharger Single Charger Firmware | 2026-08-13 | 6.8 Medium |
| Autel Maxi Charger Single firmware through V1.03.51 permits unrestricted access to the NXP i.MX6 recovery mode through exposed hardware recovery pins. An attacker with physical access can boot attacker-controlled code in memory and modify or extract firmware and other sensitive data. | ||||