ntopng versions prior to 6.7.260718 contain a vulnerability in two Lua scripts that allow any authenticated non-admin user to list and download system-configuration backups without proper administrator checks. These backups include sensitive data such as password hashes, API tokens, TOTP secrets, and WebAuthn credentials, which could lead to account compromise. The issue is resolved in version 6.7.260718.
ntopng versions prior to 6.7.260717 contain a vulnerability in certain vulnerability-scan endpoints that allows authenticated non-admin users to execute arbitrary operating system commands. This occurs because the scan_ports parameter is passed without proper administrator checks and allows shell metacharacters, leading to command injection via nmap execution. The flaw can also be exploited through a logged-in user's browser due to insufficient CSRF protection on GET requests. The issue is fixed in version 6.7.260717.
CVE-2026-94301 is a critical vulnerability in the Mina2 library related to an incomplete fix for CVE-2026-47065. The vulnerability involves a bypass of the acceptMatchers filter due to the resolveProxyClass() method not being overridden in certain maintenance branches. Although the fix was fully applied in the 2.2.X branch (starting with version 2.2.8), the 2.0.X and 2.1.X branches remain vulnerable despite version numbers indicating a fix. This allows an attacker to bypass allow-list filtering, potentially leading to full compromise with network-level attack vector and no required privileges or user interaction.
A vulnerability in Keycloak's authentication session management allows bypassing mandatory two-factor authentication (2FA) setup enforced by client policy. By visiting a specific session restart endpoint during login, a user can clear internal markers tracking required security steps and log in with only a password. This flaw requires a specific server-side configuration and affects only users not yet enrolled in 2FA. The vulnerability is rated low severity by Red Hat.
Multiple vulnerabilities have been identified in Netty, an asynchronous event-driven network application framework used for developing high-performance protocol servers and clients. The information provided does not specify the nature, impact, or affected versions of these vulnerabilities.
Pod::Text versions before 6.1.1 in Perl contain a vulnerability that allows CPU and memory exhaustion when formatting a specially crafted POD document with deeply nested =over sections. The nesting drives the margin to zero, causing an infinite loop that consumes memory and CPU resources until exhaustion occurs.
A denial of service vulnerability (CVE-2026-8674) exists in the GNU libc DNS stub resolver component. This vulnerability can be triggered via a long search domain in the resolver configuration, causing the system to become unresponsive. The issue affects the GNU libc library, which is fundamental to Linux and other Unix-like operating systems. Red Hat has classified this vulnerability as moderate severity and has released updates for Red Hat Enterprise Linux 9 to address it. The vulnerability is part of a set of glibc security issues fixed in recent updates.
Multiple security vulnerabilities affecting the Skia graphics library used in Chromium-based browsers such as Google Chrome and Microsoft Edge have been identified. These include use-after-free, cross-origin data disclosure, information disclosure, integer overflow, out-of-bounds read, memory corruption, and improper input validation issues. The vulnerabilities are addressed in an update to the webkit2gtk3 package for Red Hat Enterprise Linux 9. The update is rated as having an important security impact.
Multiple vulnerabilities have been identified in the Linux kernel, which is the core component of the Linux operating system. The information provided is limited and does not specify the nature, impact, or affected versions of these vulnerabilities.
A high-severity vulnerability (CVE-2026-83408) exists in the Oracle GraalVM for JDK compiler component affecting specific versions of Oracle GraalVM for JDK 17, 21, and 25. This vulnerability allows an unauthenticated attacker with network access via HTTP to potentially take over the affected Oracle GraalVM for JDK instances. The vulnerability has a CVSS 3.1 base score of 8.1, indicating high impact on confidentiality, integrity, and availability.
A vulnerability in Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition allows an unauthenticated attacker with network access via HTTP to potentially gain unauthorized access to critical data, perform limited unauthorized data modifications, and cause partial denial of service. The vulnerability affects specific versions of Oracle GraalVM for JDK 17, JDK 21, and Oracle GraalVM Enterprise Edition. The CVSS 3.1 base score is 7.0, indicating a high severity with impacts on confidentiality, integrity, and availability.
A high-severity vulnerability (CVE-2026-83357) exists in the Oracle GraalVM for JDK compiler component affecting specific versions of Oracle GraalVM for JDK 17, 21, and 25. This vulnerability can be exploited remotely by an unauthenticated attacker with network access via HTTP, potentially resulting in full compromise of the affected Oracle GraalVM for JDK instances. The vulnerability has a CVSS 3.1 base score of 8.1, indicating high impact on confidentiality, integrity, and availability. Oracle has released a Critical Security Patch Update addressing this and many other vulnerabilities. Users are strongly advised to apply the relevant patches promptly to mitigate risk.
This entry reports multiple vulnerabilities in the Linux Kernel as used in Debian. The Linux Kernel is the core component of the Linux operating system. No specific details about the vulnerabilities, affected versions, or impact are provided.
Multiple critical security vulnerabilities have been identified in the ANGLE component used by Google Chrome and Microsoft Edge browsers. These include arbitrary code execution, information disclosure, use-after-free, buffer overflow, and improper input validation issues. The vulnerabilities affect the ANGLE graphics engine and are addressed in updates to the webkit2gtk3 package for Red Hat Enterprise Linux 9. A security advisory from Red Hat provides patches and details on the fixed versions.
Multiple high-impact security vulnerabilities have been identified and fixed in Mozilla Firefox, Firefox ESR, and Thunderbird. These include use-after-free bugs, privilege escalations, sandbox escapes, mitigation bypasses, and information disclosures affecting various components such as Graphics (CanvasWebGL, WebRender), DOM, Networking, WebExtensions, and others. The fixes are included in Firefox 156 and Firefox ESR 115.41 releases.
A vulnerability in Keycloak prior to version 26.8.2 allows bypassing of security controls, potentially enabling unauthorized actions such as silent account re-linking. Keycloak is an open source identity and access management solution providing single sign-on capabilities. The issue is fixed in version 26.8.2.
Rustls versions from 0.23.13 up to but not including 0.23.45 improperly accept TLS 1.3 handshake messages sent at incorrect encryption levels when they follow a key-changing message in the same record. This violates RFC 8446 section 5.1, which mandates terminating the connection with an "unexpected_message" alert in such cases. The flaw allows plaintext handshake messages to be accepted without rejection, though the handshake transcript remains authenticated, limiting the attacker's ability to alter or complete the handshake.
A denial of service vulnerability (CVE-2026-19248) exists in the Qt5 and Qt6 base libraries related to XML parsing. This flaw allows an attacker to cause a denial of service via uncontrolled recursion during XML serialization. Red Hat has issued a security advisory with updates for qt5-qtbase and qt6-qtbase packages to address this issue in Red Hat Enterprise Linux 9.8 and related products.
Multiple vulnerabilities have been identified in Squid, an open-source web proxy cache server. The primary issue involves incorrect handling of certain HTTP Transfer-Encoding headers, which could allow an attacker to perform HTTP request smuggling attacks, bypass security mechanisms, or poison web caches. These vulnerabilities affect various platforms including Unix and Windows. Fixes have been released by major vendors such as Ubuntu and Red Hat.