An improper handling of exceptional conditions vulnerability exists in the aspnet-request pattern converter of Apache log4net. When reading request parameters, ASP.NET request validation can cause the layout to throw an exception if the request contains markup content, resulting in the appender discarding the entire log event. This allows a sender to suppress logging of their own request. The issue affects applications running on ASP.NET for .NET Framework that use the %aspnet-request layout pattern. The vulnerability is fixed in log4net version 3.5.0.
A vulnerability in Apache log4net's RemoteSyslogAppender causes improper encoding or escaping of output. Non-visible ASCII characters and control characters are removed rather than escaped, allowing distinct input values to appear identical in logs. This affects applications using RemoteSyslogAppender. The issue is fixed in version 3.5.0.
A heap-based buffer overflow vulnerability exists in GIMP's DICOM export plug-in. This occurs when exporting images with extremely large dimensions, causing an integer overflow during buffer allocation. The GEGL library then writes beyond the allocated buffer, potentially leading to memory corruption. The vulnerability has a CVSS score of 6.3 and is classified as medium severity.
A vulnerability in ModSecurity related to PCRE2 error handling can cause match-limit fail-open behavior and crashes due to invalid patterns. This affects multiple specific versions of ModSecurity. The severity is assessed as medium. No CVSS score or known exploits in the wild are reported.
A vulnerability in modsecurity-apache identified as CVE-2026-104259 involves the t:removeComments function mishandling the character following a comment terminator, which can lead to bypassing security rules. This issue affects multiple specific versions of modsecurity-apache. The severity is assessed as medium. No CVSS score or vendor advisory patch information is provided.
A vulnerability in modsecurity-apache identified as CVE-2026-104269 involves the RFC 2231 filename* parameter bypassing multipart filename rules. This issue affects multiple specific versions of modsecurity-apache. The severity is assessed as medium. No CVSS score or detailed impact information is provided. There is no indication of known exploits in the wild or available patches.
A vulnerability in gpgtar component of GnuPG before version 2.5.19 allows file overwrite via crafted archive data. When extracting an untrusted archive with the --directory (-C) option into an existing directory containing a symlink, gpgtar may follow the symlink and overwrite files outside the intended extraction directory. This behavior is limited by the filesystem permissions of the user performing extraction. Extracting into a fresh empty directory does not pose this risk. The issue has a low severity score and no known exploits in the wild.
A vulnerability exists in django-haystack up to version 3.3.0 in the _to_python function of haystack/backends/elasticsearch_backend.py. This flaw involves improper neutralization of directives in dynamically evaluated code due to manipulation of the result_class argument. The vulnerability can be exploited remotely. An upgrade to version 3.4.0 addresses this issue. The vulnerability has a medium severity rating with a CVSS score of 4.7.
A vulnerability in Zabbix's email media type OAuth form allows execution of arbitrary JavaScript in the browser by passing an unvalidated Authorization endpoint URL to window.open(). This can be exploited by importing a crafted media type configuration file, resulting in script execution with Super Admin privileges.
A vulnerability in the JavaScript preprocessing (Duktape) engine on Zabbix server allows a limited administrator to read raw heap data. This can lead to leakage of data from other running preprocessors that the administrator should not have access to. The vulnerability affects multiple specific versions of Zabbix server. The severity is assessed as medium based on the potential for unauthorized data exposure. No known exploits are reported in the wild. Patch status is not confirmed due to lack of vendor advisory information.
A vulnerability in Zabbix Server/Proxy allows binary items containing certain NULL byte inputs to crash the Server/Proxy, potentially causing loss of availability. This issue specifically affects deployments using MySQL or MariaDB as the backend database. The vulnerability impacts multiple specific versions of Zabbix as listed. The severity is assessed as medium based on the impact to availability without evidence of exploitation in the wild.
Zabbix frontend host search functionality allows filtering by fields not displayed, including stored IPMI and PSK credentials. A user with read access can guess credentials and verify correctness via search results, potentially exposing sensitive information.
Zabbix Server and Proxy accept active agent heartbeat messages without enforcing the configured PSK or certificate authentication. This allows an attacker with access to the Zabbix trapper port to falsely report an arbitrary host as available, compromising data integrity.
The Perl SNMP trap receiver script included with Zabbix does not properly neutralize the ZBXTRAP record delimiter within trap content. This vulnerability allows an attacker who can send SNMP traps to inject a record that targets another host, leading to a loss of data integrity.
A vulnerability identified as CVE-2026-66020 affects the QEMU virtualization software, specifically related to the virtio-gpu component. The issue involves disabling blob scanouts on mapping cleanup. Multiple Ubuntu package versions of QEMU are affected. The severity is assessed as medium. No CVSS score is provided.
CVE-2026-94291 is a medium severity vulnerability affecting multiple specific versions of the Epiphany browser. The exact nature and technical details of the vulnerability are unknown as no description or CVSS score is provided. There is no information on exploitation in the wild or available patches.
An infinite loop vulnerability exists in the Apache Thrift Python bindings in versions before 0.25.0. This flaw causes a loop with an unreachable exit condition, potentially leading to denial of service by causing the affected application to hang. The issue is fixed in Apache Thrift version 0.25.0, and users are advised to upgrade to this version to resolve the vulnerability.
An inefficient algorithmic complexity vulnerability in Apache Thrift Lua bindings allows allocation of resources without limits or throttling. This can lead to resource exhaustion. The issue affects Apache Thrift versions before 0.25.0. Upgrading to version 0.25.0 or later resolves the vulnerability.
A vulnerability exists in Apache Thrift JavaME bindings where resources can be allocated without limits or throttling, potentially leading to resource exhaustion. This affects Apache Thrift versions before 0.25.0. Upgrading to version 0.25.0 resolves the issue.
An Inefficient Algorithmic Complexity vulnerability exists in the Apache Thrift Lua bindings affecting versions before 0.25.0. This vulnerability can cause performance degradation due to inefficient processing. The issue is resolved in Apache Thrift version 0.25.0, which users are advised to upgrade to.