Security Check

security.bloxprod.io

Schwachstellen, die jetzt zählen.

CVE für Linux-Server, Android, Apple-Telefone, Windows, Browser, Krypto-Wallets und übrige Software. Ein Klick auf den Titel öffnet das Original beim Herausgeber.

6601Artikel
1293Kritisch
3008Hoch
1779Aktiv ausgenutzt
Alle StufenKritischHochMittelNiedrigAktiv ausgenutzt
Niedrig 3.7Linux-Server

actionmailbox: Action Mailbox: Inbound email forgery via Mailgun webhook signature replay

CVE-2026-126068actionmailbox10. Nov 2026

### Impact The Action Mailbox Mailgun ingress authenticates a request with an HMAC of the `timestamp` and `token` parameters concatenated without a separator, and `ActionMailbox::Ingresses::Mailgun::InboundEmailsController::Authenticator#recent?` rejects only timestamps more than 2 minutes in the past. Because the signature does not fix the boundary between the two values, a captured signed request can be presented with a timestamp far in the future, which the ingress then…

Original bei Red HatAlle Quellen (2)
Niedrig 3.1Linux-Server

actionpack: Action Pack: Cross-Site Request Forgery via missing SameSite attribute on session cookies

CVE-2026-126067actionpack10. Nov 2026

### Impact Action Pack session stores other than `ActionDispatch::Session::CookieStore` (`CacheStore`, `MemCacheStore`, and third-party stores built on `AbstractStore`, `AbstractSecureStore` or the session mixins) write the session cookie without a `SameSite` attribute, regardless of `config.action_dispatch.cookies_same_site_protection`, which defaults to `:lax`. Only `CookieStore` applies the configured policy. In browsers that do not treat a cookie without the attribute as…

Original bei Red HatAlle Quellen (2)
Niedrig 3.7Linux-Server

fast-xml-parser: fast-xml-parser: Denial of Service via quadratic rescanning of unterminated tags

CVE-2026-126066fast-xml-parser10. Nov 2026

### Summary With the non-default stopNodes option, a stop node's body with many " " anywhere after makes readStopNodeData() rescan the entire remaining input from every " ` exists - `OrderedObjParser.js:812-818` — on failure, `i` isn't advanced, so the next ` ` lookahead is neither cached nor bounded — `n` copies of ` ` means `n` scans over the remaining input, O(n²) work, before it finally throws. **Fix** 1. Throw immediately in `readStopNodeData()` when `readTagExp()`…

Original bei Red HatAlle Quellen (2)
Niedrig 2.5Linux-Server

nokogiri: nokogiri: Denial of Service via use-after-free when replacing attribute values

CVE-2026-126064nokogiri10. Nov 2026

### Summary Nokogiri's CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an existing XML attribute via `Nokogiri::XML::Node#[]=` or `Nokogiri::XML::Node#lang=`. If Ruby code had already accessed the attribute's child nodes, replacing the value could free those native child nodes while their wrappers remained reachable. Using one of those child nodes afterwards could cause an invalid read and a possible segfault. This is…

Original bei Red HatAlle Quellen (2)
Niedrig 3.7Linux-Server

nokogiri: nokogiri: Server-Side Request Forgery via network restriction bypass on JRuby

CVE-2026-126062nokogiri10. Nov 2026

### Summary On JRuby, the `NONET` parse option did not block an external DTD or entity whose system identifier used a short-form IPv4 host, such as `http://127.1/` or `http://169.254.43518/`, or was an absolute path such as `/x.dtd` in a document parsed from a network URL. An application that parses untrusted XML with `DTDLOAD`, `DTDVALID` or `NOENT` could be made to send network requests, potentially enabling SSRF. Nokogiri 1.19.5 applies the `XML::Schema` check from…

Original bei Red HatAlle Quellen (2)
Niedrig 3.7Linux-Server

node-forge: node-forge: Signature verification bypass via unvalidated small-order Ed25519 public keys

CVE-2026-125335node-forge10. Nov 2026

### Summary `ed25519.verify()` does not reject public keys of small order, such as the identity point. Under such a key, a signature with `S = 0` and a small-order `R` verifies for many messages, or for every message with the identity key, without any private key. Fixed in node-forge 1.4.3. ### Details `crypto_sign_open()` in `lib/ed25519.js` decodes the public key `A` with `unpackneg()`, which only checks that the point is on the curve, and then checks `R == [S]B - [k]A`…

Original bei Red HatAlle Quellen (2)
Niedrig 3.7Linux-Server

rack: rack: Security inspection bypass via multipart boundary parsing differential

CVE-2026-125108rack9. Nov 2026

## Summary The guard added for CVE-2026-26961 (GHSA-vgpv-f759-9wx3), which rejects multipart requests with more than one `boundary` parameter, only inspects the part of the `Content-Type` header after the boundary it extracts. A `Content-Type` whose first `boundary` parameter is empty or begins with a quote, semicolon, or comma is skipped by the extraction pattern, so a second `boundary` parameter is accepted silently and Rack parses the body with a boundary that a…

Original bei Red HatAlle Quellen (2)