A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent...
CVE-2026-48930
A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c
#severity:medium
共收录 5559 条相关情报。
← 返回所有主题A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context...
CVE-2026-48928
A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnera
A flaw was found in Apicurio Registry. The DocumentBuilderAccessor correctly blocks external DTD...
CVE-2026-12993
A flaw was found in Apicurio Registry. The DocumentBuilderAccessor correctly blocks external DTD and schema access but d
A flaw was found in the Pen Drive report generator. Cluster-sourced data is rendered into HTML...
CVE-2026-13083
A flaw was found in the Pen Drive report generator. Cluster-sourced data is rendered into HTML reports without proper es
A flaw was found in KubeVirt's virt-handler network cache handling. The WriteToCachedFile...
CVE-2026-13218
A flaw was found in KubeVirt's virt-handler network cache handling. The WriteToCachedFile function writes data to a laun
A server-side request forgery (SSRF) flaw was found in KubeVirt's virt-api port-forward handler....
CVE-2026-13318
A server-side request forgery (SSRF) flaw was found in KubeVirt's virt-api port-forward handler. When processing a port-
The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows...
CVE-2026-54479
The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to
PKCS7_verify signer confusion allows forged signatures, where the signer associated with a...
CVE-2026-7511
PKCS7_verify signer confusion allows forged signatures, where the signer associated with a signature is not correctly bo
PKCS#12 MAC verification uses an attacker-controlled comparison length, weakening the integrity...
CVE-2026-6329
PKCS#12 MAC verification uses an attacker-controlled comparison length, weakening the integrity check on the MAC and all
Charging station authentication identifiers are publicly accessible via web-based mapping platforms.
CVE-2026-44622
Charging station authentication identifiers are publicly accessible via web-based mapping platforms.
iPAddress name constraints bypass when WOLFSSL_IP_ALT_NAME is not defined. IP address name...
CVE-2026-7532
iPAddress name constraints bypass when WOLFSSL_IP_ALT_NAME is not defined. IP address name constraints are not enforced
TLS 1.3 post-handshake authentication (PHA) issue where a server could accept a client's Finished...
CVE-2026-55962
TLS 1.3 post-handshake authentication (PHA) issue where a server could accept a client's Finished message without the cl
The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the...
CVE-2026-6330
The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the Fujisaki-Okamoto transform's i
wc_Blake2bHmacFinal and wc_Blake2sHmacFinal discard the message when the key length exceeds the...
CVE-2026-8720
wc_Blake2bHmacFinal and wc_Blake2sHmacFinal discard the message when the key length exceeds the block size, producing a
Use after free in Payments in Google Chrome on Android prior to 149.0.7827.201 allowed a local...
CVE-2026-13282
Use after free in Payments in Google Chrome on Android prior to 149.0.7827.201 allowed a local attacker to potentially e
OCSP CertID serial-number length-confusion in wolfSSL_OCSP_resp_find_status allows a same-issuer...
CVE-2026-10098
OCSP CertID serial-number length-confusion in wolfSSL_OCSP_resp_find_status allows a same-issuer SingleResponse whose se
Missing SNI/ALPN binding on stateful (session-ID) resumption, which previously skipped the...
CVE-2026-11703
Missing SNI/ALPN binding on stateful (session-ID) resumption, which previously skipped the binding check performed for t
Grav before 1.6.30 contains a cross-site scripting vulnerability in the Admin plugin page editor...
CVE-2020-37256
Grav before 1.6.30 contains a cross-site scripting vulnerability in the Admin plugin page editor default security config
golang.org/x/crypto/ssh: Invoking memory leak when rejecting channels can lead to DoS
CVE-2026-39827
An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory gr
golang.org/x/crypto/ssh is vulnerable to invoking server panic during CheckHostKey/Authenticate flow
CVE-2026-39835
SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be c