Archive
8 October 2026
Vulnerabilities first published on this day (UTC), newest first.
186 results · Clear filters · Feed
-
High 7.5
HTTP/2 server crash due to HPACK encoder race in net/http
HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part …
-
High 7.5
HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http
When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the …
-
High 7.5
Lack of limit on size of parsed Range headers in net/http
When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.
-
High 7.5
HTTP/2 transport accepts malformed framing-related headers in net/http
Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such header…
-
High 7.5
Excessive CPU consumption from repeated initial window changes in net/http
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.
-
High 7.5
Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart
Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.
-
High 7.5
Reject malformed ECH outer extension references in crypto/tls
Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and …
-
High 7.5
HTTP/1 client connection desynchronization after CONNECT rejection in net/http
When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport…
-
High 7.5
HTTP/2 server memory exhaustion due to Trailer headers in net/http
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicio…
-
High 7.8
Checksum bypass for golang.org/fips140 in cmd/go
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted ziphash for the bund…
-
High 7.8
Checksum database bypass for golang.org/toolchain in cmd/go
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always g…
-
High 7.1
SumatraPDF — Windows command-line argument injection in AI selection-translate
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, src/SelectionTranslate.cpp embeds selected or pasted translation text in quoted Windows command lines using incomplete quote-only escaping. The affected BuildGrokTranslateCmdLineTemp(), Bu…
-
High 7.1
SumatraPDF: SyncTeX Argument Injection in Inverse Search Enables Arbitrary Command Execution via External Editors
SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, an attacker-controlled SyncTeX source filename is substituted for the %f placeholder in an external editor command line without safe Windows argument quoting, and the resulting command lin…
-
High 8.4
SumatraPDF: Markup/command-link injection into UI notification text
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, untrusted document paths and PDF link targets are interpolated into notification text that ParseTip() interprets as trusted tip markup. When a user clicks an injected link, ExecuteTipLink(…
-
High 8.7
Predictable Media Stream Pre-Shared Key Vulnerability in TP-Link Tapo C325WB
TP-Link Tapo C325WB V2 generates the pre-shared key used by its local media streaming service with a time-seeded pseudo-random number generator, making the key predictable and recoverable. An unauthenticated attacker on the adjacent network can recover the ke…
-
High 8.7
Unauthenticated JSON API Authorization Bypass Vulnerability in TP-Link Tapo C325WB
TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass vulnerability in the HTTPS JSON API dispatcher on TCP port 443. An attacker on the adjacent network can append an onboarding-scoped object to a JSON request to bypass session verification…
-
High 7.1
Unauthenticated RTSP Tunnel Denial-of-Service Vulnerability in TP-Link Tapo C325WB
An unauthenticated denial-of-service vulnerability exists in Tapo C325WB v2 in the RTSP streaming service on TCP port 554 when the Camera Account feature is enabled. A crafted pair of RTSP-over-HTTP tunneling requests can cause memory corruption and crash the…
-
High 7.7
Azure Event Grid Spoofing Vulnerability
Missing authorization in Azure Event Grid allows an authorized attacker to perform spoofing over a network.
-
High 8.7
Azure API Center Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Azure API Center allows an unauthorized attacker to disclose information over a network.
-
High 7.5
Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy
Strawberry GraphQL is a library for creating GraphQL APIs. From 0.217.0 until 0.326.1, PermissionExtension.resolve() on a synchronous field resolver evaluates the result of has_permission() for truthiness. When a custom permission declares has_permission() as…
-
High 8.7
Hazelcast: Authorization bypass in IMap Predicates API
Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, missing authorization checks in the IMap Predicates API allow a malicious client with limited privileges to execute arbitrary…
-
High 7.4
fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery
fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret because src/crypto.js performDetectPublicKeyAlgorithms treats non-PEM strings as symmetric key material. If HS…
-
High 8.1
fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array
fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.0, fast-jwt createVerifier accepts a validly signed JWT whose payload is a JSON array because src/decoder.js checks that the payload is an object but does not reject arrays. The claim va…
-
High 8.8
Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution
A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates member paths using lexical path normalisation (os.path.abspath) instead of resolving symbolic links (os.path.realpath), an…
-
High 7.4CVE-2026-107720 Public exploit
fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set
fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.1, fast-jwt createVerifier accepts an unsigned JWT when key is an empty string or null and algorithms is a non-empty allowlist. Falsy synchronous keys bypass prepareKeyOrSecret, allowedA…
-
High 7.3
Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry
Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.1, Banks DirectoryPromptRegistry does not reject symbolic links for index.json or discovered and existing .jinja prompt files. In an application where untrusted users can in…
-
High 8.1
Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.
-
High 8.1
IBM Guardium Data Protection is affected by multiple vulnerabilities.
IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to delete arbitrary files due to improper limitation of a pathname to a restricted directory.
-
High 8.6
Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection
IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end databas…
-
High 8.1
Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow.
-
High 8.1
IBM Guardium Data Protection is affected by multiple vulnerabilities.
IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
-
High 8.1
Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection
IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a buffer overrun in the TDS (Microsoft SQL Server) PRELOGIN packet decoder. A remote attacker who can send a specially crafted TDS PRELOGIN packet to a network monitored by an IBM Guardium Col…
-
High 8.1
Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.
-
High 8.1
IBM Guardium Data Protection is affected by multiple vulnerabilities.
IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.
-
High 7.5
IBM Guardium Data Protection is affected by multiple vulnerabilities
IBM Guardium Data Protection 12.2.2 could allow a remote attacker to cause a denial of service due to a race condition resulting from concurrent unsynchronized writes to a shared map.
-
High 8.1
Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.
-
High 8.1
IBM Guardium Data Protection is affected by multiple vulnerabilities.
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability.
-
High 7.5
Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.
-
High 7.8CVE-2026-11318 Public exploit
Deskin 3.3.4.3 XPC Service Privilege Escalation via Unauthenticated Installer
Deskin through 3.3.4.3 contains a privilege escalation vulnerability in the com.deskin.service.installer XPC service that allows local unprivileged attackers to execute arbitrary installer packages as root by connecting to the root-owned service without authe…
-
High 8.8
Satel Netco Design Relative path traversal
Satel Netco Design versions prior to v2.1.7 contains a relative path traversal vulnerability in its data export functionality. An authenticated user with Viewer privileges could write attacker influenced content to file system locations accessible to the appl…