CVE Notifier

CVE-2026-85271 CWE-79 6.1

Open edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857)

Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the add_additional_attributes_to_notifications function in openedx/core/djangoapps/notificatio…

cve.org openedx:openedx-platform 22 jam lalu

CVE-2026-93894 CWE-787 N/A

CVE-2026-93894

In Vinyl Cache before 9.0,2, workspace buffer overflow vulnerability was found in the .upper() and .lower() string type methods of VCL. This can be used as a remote denial of service (DoS) vector to make the child proces…

cve.org Vinyl-Cache:Vinyl · Cache · Varnish-Software:Varnish 22 jam lalu

CVE-2026-85272 CWE-22 4.3

Open edX Platform: Path traversal via prefix-bypass in safe_extractall Path Validation

Open edX Platform enables the authoring and delivery of online learning at any scale. From Aspen.1 until Ulmo and Verawood.1, openedx/core/lib/extract_archive.py uses _is_bad_path to validate safe_extractall targets by c…

cve.org openedx:openedx-platform 22 jam lalu

CVE-2026-71855 CWE-697 5.9

Suricata flow: IPv4/IPv6 hash collision can reuse wrong flow state

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, src/flow-hash.c can treat an IPv4 and IPv6 flow as equal without comparing …

cve.org OISF:suricata 22 jam lalu

CVE-2026-71418 CWE-407 7.5

Suricata doh2: crafted HTTP/2 DATA frames can cause quadratic CPU consumption

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, DNS-over-HTTP/2 processing in rust/src/http2/http2.rs retains previously proce…

cve.org OISF:suricata 22 jam lalu

CVE-2026-57223 CWE-428 7.0

Suricata windows: unquoted LocalSystem service ImagePath can allow local privilege escalation

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the Windows service installation and parameter-update logic in src/win32-se…

cve.org OISF:suricata 22 jam lalu

CVE-2026-63446 CWE-401 7.5

Suricata app-layer: passed flows can retain transactions, causing resource exhaustion

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, AppLayerParserSetTransactionInspectId() in src/app-layer-parser.c uses an inve…

cve.org OISF:suricata 22 jam lalu

CVE-2026-63447 CWE-407 7.5

Suricata ftp: crafted FTP traffic can cause quadratic CPU consumption

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.5 until 8.0.6, the FTP parser in src/app-layer-ftp.c can continue allocating transactions aft…

cve.org OISF:suricata 22 jam lalu

CVE-2026-63448 CWE-400 5.9

Suricata smb: some SMB flows can cause resource exhaustion

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the SMB parser can retain force-completed transactions on flows where Suric…

cve.org OISF:suricata 22 jam lalu

CVE-2026-57229 CWE-665 5.3

Suricata smtp/mime: incomplete state reset allows detection bypass

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the SMTP MIME parser in rust/src/mime/smtp.rs does not fully reset state when …

cve.org OISF:suricata 22 jam lalu

CVE-2026-57225 CWE-476 3.3

Suricata datasets: NULL pointer dereference in JSON/NDJSON dataset loading

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, src/datasets-context-json.c assumes that a configured JSON or NDJSON dataset v…

cve.org OISF:suricata 22 jam lalu

CVE-2026-63452 CWE-400 7.5

Suricata http1: repeated brotli compression bombs can cause excessive CPU consumption

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the HTTP/1 parser limits decompression work per transaction but does not limit…

cve.org OISF:suricata 22 jam lalu