Kategorie: Allgemein

CVE-2025-69873 ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., „^(a|a)*$“) combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation.

Information published.

CVE-2026-27969 Vitess users with backup storage access can write to arbitrary file paths on restore

Information published.

CVE-2026-27965 Vitess users with backup storage access can gain unauthorized access to production deployment environments

Information published.

Junos OS Evolved: Update außer der Reihe stopft Codeschmuggel-Lücke

In Junos OS Evolved der PTX-Serie von Juniper Networks klafft eine kritische Sicherheitslücke. Ein ungeplantes Update schließt sie.

Chromium: CVE-2026-3063 Inappropriate implementation in DevTools

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2024 ) for more information.

Chromium: CVE-2026-3062 Out of bounds read and write in Tint

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2024 ) for more information.

Chromium: CVE-2026-3061 Out of bounds read in Media

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2024 ) for more information.

[NEU] [mittel] Trellix Endpoint Security: Schwachstelle ermöglicht Privilegieneskalation

Ein lokaler Angreifer kann eine Schwachstelle in Trellix Endpoint Security ausnutzen, um seine Privilegien zu erhöhen.

[NEU] [mittel] MailPit: Schwachstelle ermöglicht Offenlegung von Informationen

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in MailPit ausnutzen, um SSRF-Angriffe durchzuführen, die zur Offenlegung von Informationen führen können.

[NEU] [mittel] Wireshark: Mehrere Schwachstellen ermöglichen Denial of Service

Ein lokaler Angreifer kann mehrere Schwachstellen in Wireshark ausnutzen, um einen Denial of Service Angriff durchzuführen.

©  2026 Leibling.de. Erstellt mit WordPress und dem Highlight Theme