CVE Watch17 jul 2026

CVE-2026-21764

HCL DevOps Loop is affected by insufficient input validation that allows special characters where they should be restricted. This may result

CVSS

3.1

Bajo

EPSS

0.2%

KEV

—

Exploit Today

0-100

Publicado: 17 jul 2026 · Última mod.: 17 jul 2026 · CWE-754

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

HCL DevOps Loop is affected by insufficient input validation that allows special characters where they should be restricted. This may result in unintended application behavior under certain conditions.

Referencias oficiales

support.hcl-software.comhttps://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132296

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-256397.5 ALT

82.9%

——25Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service. This vulnerability is fixed in versions 0.30.3 and 1.13.5.2d CVE-2026-59467.5 ALT

76.2%

——23Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in the question section. Specially crafted requests reaching the affected code paths — recursion, dynamic updates (`UPDATE`), zone change notifications (`NOTIFY`), or processing of `IN`-specific record types in non-`IN` data — can cause assertion failures in `named`. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.4d CVE-2026-46947.5 ALT

51.6%

——15Incorrect boundary conditions, integer overflow in the Graphics component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.4d CVE-2026-46908.6 ALT

51.6%

——15Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.4d CVE-2026-46867.5 ALT

49.1%

——15Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.4d CVE-2026-46857.5 ALT

48.6%