https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 13:14:49 +0000 https://cve.radiocsirt.org/vuln/certfr-2023-avi-0272 certfr-2023-avi-0272 https://cve.radiocsirt.org/vuln/certfr-2023-avi-0272 https://cve.radiocsirt.org/vuln/cleanstart-2026-pt09141 <p><strong>Affected:</strong> CleanStart: wavefront-collector-for-kubernetes</p> <p>Security vulnerability affects the wavefront-collector-for-kubernetes package. This issue is resolved in later releases. See references for vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: wavefront-collector-for-kubernetes</p> <p>Security vulnerability affects the wavefront-collector-for-kubernetes package. This issue is resolved in later releases. See references for vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-pt09141 https://cve.radiocsirt.org/vuln/euvd-2026-227110 EUVD-2026-227110 https://cve.radiocsirt.org/vuln/euvd-2026-227110 https://cve.radiocsirt.org/vuln/fkie_cve-2022-41721 <p>A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be attacker-manipulated to represent arbitrary HTTP2 requests.</p> <p>A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be attacker-manipulated to represent arbitrary HTTP2 requests.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-41721 https://cve.radiocsirt.org/vuln/ghsa-fxg5-wq6x-vr4w <p><strong>Affected:</strong> Go: golang.org/x/net</p> <p>A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be attacker-manipulated to represent arbitrary HTTP2 requests.</p> <p>### Specific Go Packages Affected golang.org/x/net/http2/h2c</p> <p><strong>Affected:</strong> Go: golang.org/x/net</p> <p>A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be attacker-manipulated to represent arbitrary HTTP2 requests.</p> <p>### Specific Go Packages Affected golang.org/x/net/http2/h2c</p> https://cve.radiocsirt.org/vuln/ghsa-fxg5-wq6x-vr4w https://cve.radiocsirt.org/vuln/gsd-2022-41721 gsd-2022-41721 https://cve.radiocsirt.org/vuln/gsd-2022-41721 https://cve.radiocsirt.org/vuln/msrc_cve-2022-41721 msrc_CVE-2022-41721 https://cve.radiocsirt.org/vuln/msrc_cve-2022-41721 https://cve.radiocsirt.org/vuln/opensuse-su-2024:12666-1 <p>caddy-2.6.3-1.1 on GA media</p> <p>caddy-2.6.3-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:12666-1 https://cve.radiocsirt.org/vuln/rhsa-2023:1326 <p>go-yaml: Denial of Service in go-yaml goutils: RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be mongo-go-driver: specific cstrings input may not be properly validated golang: out-of-bounds read in golang.org/x/text/language leads to DoS prometheus/client_golang: Denial of service using InstrumentHandlerCounter helm: Denial of service through through repository index file helm: Denial of service through schema file golang: crash in a golang.org/x/crypto/ssh server vault: insufficient certificate revocation list checking golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests x/net/http2/h2c: request smuggling golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding golang: crypto/tls: large handshake records may cause panics golang: net/http, mime/multipart: denial of service from excessive resource consumption exporter-toolkit: authentication bypass via cache poisoning vault: Vault’s Microsoft SQL Database Storage Backend Vulnerable to SQL Injection Via Configuration File hashicorp/vault: Vault’s PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata hashicorp/vault: Cache-Timing Attacks During Seal and Unseal Operations helm: getHostByName Function Information Disclosure containerd: Supplementary groups are not set up properly runc: Rootless runc makes `/sys/fs/cgroup` writable runc: volume mount race condition (regression of CVE-2019-19921) runc: AppArmor can be bypassed when `/pro…</p> <p>go-yaml: Denial of Service in go-yaml goutils: RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be mongo-go-driver: specific cstrings input may not be properly validated golang: out-of-bounds read in golang.org/x/text/language leads to DoS prometheus/client_golang: Denial of service using InstrumentHandlerCounter helm: Denial of service through through repository index file helm: Denial of service through schema file golang: crash in a golang.org/x/crypto/ssh server vault: insufficient certificate revocation list checking golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests x/net/http2/h2c: request smuggling golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding golang: crypto/tls: large handshake records may cause panics golang: net/http, mime/multipart: denial of service from excessive resource consumption exporter-toolkit: authentication bypass via cache poisoning vault: Vault’s Microsoft SQL Database Storage Backend Vulnerable to SQL Injection Via Configuration File hashicorp/vault: Vault’s PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata hashicorp/vault: Cache-Timing Attacks During Seal and Unseal Operations helm: getHostByName Function Information Disclosure containerd: Supplementary groups are not set up properly runc: Rootless runc makes `/sys/fs/cgroup` writable runc: volume mount race condition (regression of CVE-2019-19921) runc: AppArmor can be bypassed when `/pro…</p> https://cve.radiocsirt.org/vuln/rhsa-2023:1326 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0794 <p>Ein Angreifer kann mehrere Schwachstellen in Dell ECS ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuführen, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuführen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Dell ECS ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuführen, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuführen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0794