Security Check

security.bloxprod.io

Schwachstellen, die jetzt zählen.

CVE für Linux-Server, Android, Apple-Telefone, Windows, Browser, Krypto-Wallets und übrige Software. Ein Klick auf den Titel öffnet das Original beim Herausgeber.

6601Artikel
1293Kritisch
3008Hoch
1779Aktiv ausgenutzt
Alle StufenKritischHochMittelNiedrigAktiv ausgenutzt
Kritisch 9.0Linux-Server

Microsoft Developer Tools: Mehrere Schwachstellen

CVE-2026-114146Microsoft Visual Studio 2022, Red Hat Enterprise Linux, Microsoft ASP.NET, Microsoft Azure DevOps Server, Microsoft…10. Nov 2026

## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. SignalR connections are not consistently bound to the identity negotiated at connection establishment, allowing injected messages to execute Hub invocations as the victim. ## Announcement Announcement for this issue can be found at…

Original bei Red HatAlle Quellen (3)
Kritisch 9.8Aktiv ausgenutztLinux-Server

OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability

CVE-2026-123158OpenSSH5. Nov 2026

sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.

Original bei Red HatAlle Quellen (14)
Kritisch 9.9Linux-Server

pgadmin4: pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-quoted identifier

CVE-2026-116241pgadmin430. Okt 2026

pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy (...) TO command and checks that the query's parentheses are balanced so that nothing can escape the wrapper. The check rejected a backslash inside a single-quoted string, but not inside a double-quoted identifier, where it treated the next double quote as closing the identifier. psql's \copy parser applies the connection's escape character to whichever quote opened a token, so with…

Original bei Red HatAlle Quellen (2)
Kritisch 9.8Linux-Server

pgadmin4: pgadmin4: Account takeover via account lockout bypass

CVE-2026-116238pgadmin430. Okt 2026

In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins (3 by default). The limit could be bypassed, giving an unauthenticated attacker an unlimited number of password guesses against any internal account, including the administrator's, in the default configuration: - Flask-Security registers its own views next to pgAdmin's. A login submitted to its /login view was checked and logged in without pgAdmin's failed login count or lock. Its…

Original bei Red HatAlle Quellen (2)