Search: 22.9-18

A Server-Side Request Forgery (SSRF) vulnerability in Roundcube allows bypass of the is_local_url() filter via NAT64 64:ff9b::/96 addresses. This vulnerability affects multiple specific versions of Roundcube and has a high severity rating with a CVSS score of 7.2. The flaw could allow an attacker to cause the server to make unauthorized requests, potentially leading to information disclosure or other impacts.

A vulnerability in Roundcube allows bypassing remote content blocking via SVG SMIL by attribute. This issue affects multiple specific versions of Roundcube and has a medium severity rating with a CVSS score of 5.3. The vulnerability does not require privileges or user interaction to exploit and impacts confidentiality without affecting integrity or availability.

A Cross-Site Request Forgery (CSRF) validation bypass vulnerability exists in the mark-as-junk action of Roundcube. This flaw allows an attacker to perform unauthorized mark-as-junk actions without proper CSRF validation. The vulnerability has a low severity score and affects multiple specific versions of Roundcube.

Rex versions through 1.16.1 for Perl have a vulnerability where remote rsync transfers accept unknown SSH host keys due to hardcoded StrictHostKeyChecking=no. This allows an attacker who can redirect the connection to present their own host key, bypassing host key verification. Under password authentication, the attacker can capture the connection password, and file uploads or downloads proceed with the attacker-controlled server.

A high-severity vulnerability (CVE-2026-96778) affects the Pillow Python imaging library in versions from 9.4.0 up to 13.0.0. The vulnerability relates to the ImagingJp component. The CVSS 4.0 base score is 7.7, indicating a high impact with network attack vector, low attack complexity, and partial user interaction required. The vulnerability impacts confidentiality, integrity, and availability. No public exploits or patches are currently documented in the provided data.

A high-severity vulnerability (CVE-2026-96644) affects the Pillow Python imaging library on Windows platforms prior to version 13.0.0. The vulnerability has a CVSS 4.0 base score of 7.1, indicating a network-exploitable issue with low attack complexity and no privileges required, but requires user interaction. The impact is high, though no public exploits or vendor patch information are provided in the data.

A high-severity vulnerability (CVE-2026-96643) affects the Pillow Python imaging library in versions from 11.0.0 up to 13.0.0. The issue relates to the Exif.load functionality, though specific technical details are not fully provided. The CVSS 4.0 score is 7.1, indicating a significant security risk. The vulnerability is present in multiple Ubuntu package versions of Pillow. No public exploit or patch information is currently available.

CVE-2026-96642 is a high-severity vulnerability in the Pillow Python imaging library affecting versions prior to 13.0.0. The issue relates to the TarIO initialization process, potentially allowing an attacker to exploit the library. The CVSS 4.0 base score is 7.1, indicating a significant risk. Multiple Ubuntu package versions of Pillow are affected. No public exploits or vendor patches are currently documented.

A vulnerability exists in the Pillow Python imaging library prior to version 13.0.0 affecting the PILfont text-width functionality. The flaw has a CVSS 3.1 base score of 6.5, indicating a medium severity impact primarily causing availability disruption. No known exploits are reported in the wild. Multiple Ubuntu package versions of Pillow are affected.

A high-severity vulnerability (CVE-2026-96640) affects the Pillow Python imaging library versions from 5.1.0 up to 13.0.0. The issue involves the PdfParser component, though specific technical details are not provided. The vulnerability has a CVSS 4.0 base score of 8.2, indicating a network-exploitable flaw with high impact. Multiple Ubuntu package versions of Pillow are affected. No public exploits or vendor patch information are available in the provided data.

A critical vulnerability (CVE-2026-96639) affects the Pillow Python imaging library in versions from 11.0.0 up to 13.0.0. The vulnerability has a CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. The affected versions include multiple Ubuntu package builds of Pillow. No public exploits or vendor patch information are provided in the data.

A vulnerability exists in the Pillow Python imaging library affecting versions from 9.1.0 up to but not including 13.0.0. The issue relates to the BmpRleDec component. The CVSS 3.1 base score is 6.5, indicating a medium severity impact primarily affecting availability. No public exploits or known active exploitation have been reported. The affected versions include specific Ubuntu package builds of Pillow. No patch or remediation details are provided in the available data.

A vulnerability exists in the Pillow Python imaging library prior to version 13.0.0 affecting the SpiderImageFile.s component. This flaw has a CVSS 4.0 base score of 7.1, indicating high severity. The vulnerability allows an attacker to cause a high impact without requiring privileges or user interaction beyond what is specified. Multiple Ubuntu package versions of Pillow are affected. No public exploits or vendor patch information are provided in the input.

A vulnerability exists in the Pillow Python imaging library prior to version 13.0.0 involving the MpoImageFile.seek function. The flaw can cause a denial of service condition. The issue affects multiple Ubuntu package versions of Pillow. The CVSS score is 6.5, indicating a medium severity impact primarily due to availability disruption.

Apache Traffic Server contains a vulnerability that can cause the server to crash due to a null pointer dereference. This issue affects multiple specific versions of the Traffic Server package. The vulnerability has a CVSS 3.1 base score of 5.9, indicating a medium severity impact primarily affecting availability without compromising confidentiality or integrity.

Apache Traffic Server's experimental tsmemcache plugin contains a critical vulnerability allowing unauthenticated remote attackers to cause a complete compromise of confidentiality, integrity, and availability. The vulnerability affects multiple specific versions of Traffic Server. The CVSS score is 9.0, indicating a critical severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. No public exploits or vendor patch information is provided in the data.

Apache Traffic Server versions including 9.2.15, 10.1.4, and 10.2.0 have a vulnerability identified as CVE-2026-111810. The issue involves an unthrottled write operation, which can lead to a high severity impact on availability. The CVSS score is 7.5, indicating a high severity vulnerability with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability.

Apache Traffic Server contains a critical vulnerability (CVE-2026-111809) that allows HTTP request smuggling via HEAD requests. This flaw can lead to high-impact integrity violations without requiring authentication. The vulnerability affects multiple specific versions of Traffic Server as listed. The CVSS score is 9.3, indicating critical severity. There is no indication of known exploits in the wild or available patches in the provided data.

Apache Traffic Server versions including 5.3.0-2ubuntu1 through 9.2.3+ds-1+deb12u1build1 contain a critical vulnerability (CVE-2026-111816) where the server forwards a malformed 302 HTTP response improperly. This vulnerability has a high CVSS score of 9.3, indicating critical severity with potential impact on confidentiality and integrity. There is no public information on exploits in the wild or patch availability in the provided data.

A high-severity vulnerability (CVE-2025-55702) affects Trafficserver versions including multiple Ubuntu package builds from 5.3.0-2ubuntu1 through 9.2.3+ds-1+deb12u1build1. The issue involves handling of POST requests with the Expect: 100-continue header and the origin header, potentially leading to a critical impact on confidentiality and integrity without requiring privileges or user interaction.