CVE Notifier

CVE-2026-93504 CWE-284 6.3

SveltyCMS User Attribute Update Endpoint +server.ts access control

A vulnerability has been found in SveltyCMS 0.0.6. This affects an unknown part of the file src/routes/api/[...path]/+server.ts of the component User Attribute Update Endpoint. Such manipulation leads to improper access …

cve.org n/a:SveltyCMS 1 hari lalu

CVE-2026-93492 CWE-1035 5.3

Io.netty/netty-codec-http2: netty: http/2 hpackencoder dos with large table size

A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE. This causes the HpackEncoder to store an excessive number of …

cve.org Red · Hat:Red · Hat 1 hari lalu

CVE-2026-93491 CWE-770 7.5

Io.netty/netty-codec-http: netty: denial of service via unbounded httpservercodec http/1.1 pipeline queue

A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and withholding reads. This action causes the methodOv…

cve.org Red · Hat:Red · Hat 1 hari lalu

CVE-2026-93488 CWE-770 7.5

Io.netty/netty-codec-http: netty: denial of service via unbounded concurrent spdy streams

A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides no API to change it. …

cve.org Red · Hat:Red · Hat 1 hari lalu

CVE-2026-28199 CWE-347 3.3

Sensitive File Disclosure via Relative Path Traversal in NetBackup Flex OS Shell

An authenticated user with access to the NetBackup Flex OS management shell could read arbitrary files from the underlying operating system by supplying a specially crafted path argument to a diagnostic command. Succe…

cve.org Cohesity:NetBackup · Flex · OS 1 hari lalu

CVE-2026-21806 CWE-557 3.1

HCL BigFix Service Management was affected with Admin Session Concurrency vulnerability (CVE-2026-21806)

HCL BigFix Service Management is affected by an Administrative Session Concurrency vulnerability. The application allows multiple simultaneous authenticated sessions for the same administrative account, which could enabl…

cve.org HCL · Software:HCL · BigFix 1 hari lalu

CVE-2026-28198 CWE-347 8.8

Privilege Escalation via Cryptographic Signature Verification Bypass in NetBackup Flex OS Shell

An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could bypass the cryptographic signature verification step of a privileged support command by supplying a specially formed ac…

cve.org Cohesity:NetBackup · Flex · OS 1 hari lalu

CVE-2026-28197 CWE-88 8.8

Privilege Escalation via Argument Injection in NetBackup Flex OS Shell

An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could supply a specially crafted input to a privileged administrative command, causing it to execute arbitrary code with root…

cve.org Cohesity:NetBackup · Flex · OS 1 hari lalu

CVE-2026-93563 CWE-1035 7.5

Io.netty/netty-codec-smtp: netty: unbounded multi-line response accumulation in smtpresponsedecoder leads to memory-exhaustion dos

A flaw was found in Netty's `SmtpResponseDecoder` component. A remote attacker, acting as a malicious or man-in-the-middle (MITM) SMTP server, could exploit this by sending a specially crafted, unbounded multi-line SMTP …

cve.org Red · Hat:Red · Hat 1 hari lalu

CVE-2026-81627 CWE-787 6.7

Qemu-kvm: vapic writable rom alias can escape the option-rom window and expose locked smram

A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this al…

cve.org Red · Hat:Red · Hat 1 hari lalu

CVE-2026-93578 CWE-1035 5.9

Io.netty/netty-handler-ssl-ocsp: netty: missing extended key usage (eku) check in ocsp client allows certificate revocation bypass

A flaw was found in Netty's Online Certificate Status Protocol (OCSP) Client. The client fails to verify the 'id-kp-OCSPSigning' Extended Key Usage (EKU) in OCSP responder certificates. A remote attacker, holding any val…

cve.org Red · Hat:Red · Hat 1 hari lalu

CVE-2026-93572 CWE-770 7.5

Io.netty/netty-codec-redis: netty: redisarrayaggregator nested resp headers multiply patched preallocation limits

A flaw was found in Netty's `RedisArrayAggregator` component. A remote attacker can exploit this vulnerability by sending specially crafted nested Redis (RESP) array headers. This can cause the `RedisArrayAggregator` to …

cve.org Red · Hat:Red · Hat 1 hari lalu