Security Check

security.bloxprod.io

Schwachstellen, die jetzt zählen.

CVE für Linux-Server, Android, Apple-Telefone, Windows, Browser, Krypto-Wallets und übrige Software. Ein Klick auf den Titel öffnet das Original beim Herausgeber.

11947Artikel
1578Kritisch
6147Hoch
1779Aktiv ausgenutzt
Alle StufenKritischHochMittelNiedrigAktiv ausgenutzt
Hoch 8.7Linux-Server

kore: kore: Denial of Service via integer underflow in HTTP request body handling

CVE-2026-121727kore3. Nov 2026

Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass http_body_max by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections, wrapping content_length to grow buffers unbounded and exhaust worker memory.

Original bei Red HatAlle Quellen (2)
Hoch 8.2Linux-Server

@angular/router: @angular/router: Denial of Service via query parameter memory retention during server-side rendering

CVE-2026-111751@angular/router3. Nov 2026

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 21.2.0 until 21.2.25 and 22.2.1, RouterLink directives rendered during Node.js server-side rendering retain computed UrlTree instances for the lifetime of each request. When queryParamsHandling is set to merge or preserve, either per link or through defaultQueryParamsHandling, every rendered link can retain a copy of attacker-controlled…

Original bei Red HatAlle Quellen (2)
Mittel 6.1Linux-Server

@angular/platform-server: @angular/platform-server: Open redirect via improper URL normalization in server-side rendering

CVE-2026-111754@angular/platform-server3. Nov 2026

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, ServerPlatformLocation in Angular server-side rendering checks for protocol-relative URLs before WHATWG URL normalization. A request path containing a popping dot segment followed by multiple slashes can bypass the raw resolveUrl check and normalize to a pathname beginning with two slashes. When Angular SSR…

Original bei Red HatAlle Quellen (2)
Hoch 8.2Linux-Server

@angular/router: @angular/router: Denial of Service via improper route outlet matching in Server-Side Rendering

CVE-2026-111752@angular/router3. Nov 2026

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, @angular/router in Node.js server-side rendering fails to require auxiliary outlet URL segments to match routes configured for their outlet names. Crafted requests containing multiple unconfigured empty-path outlet groups can repeatedly evaluate the route configuration, construct duplicate…

Original bei Red HatAlle Quellen (2)