151283 matches found
Regular Expression Denial of Service (ReDoS)
Overview js-toml is an A TOML parser for JavaScript/TypeScript, targeting TOML 1.0.0 Spec Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the parseBigInt function used by the load process. An attacker can cause excessive CPU consumption and block...
EUVD-2026-38057
Statamic CMS's unsafe method invocation via collection sorting allows data destruction...
CVE-2026-49869
creationtimestamp| type| source ---|---|--- 2026-06-26 21:55:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp7wpquuw42c 2026-06-26 22:48:16+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mp7znrg3ri2v 2026-06-27 17:01:02+00:00| seen|...
CVE-2026-53303
In the Linux kernel, the following vulnerability has been resolved: f2fs: protect extensionlist reading with sblock in f2fssbishow In f2fssbishow, the extensionlist, extensioncount and hotextcount are read without holding sbi-sblock. If a concurrent sysfs store modifies the extension list via...
UBUNTU-CVE-2026-53284
In the Linux kernel, the following vulnerability has been resolved: btrfs: only release the dirty pages io tree after successful writes WARNING With extra warning on dirty extent buffers at umount aka, the next patch in the series, test case generic/388 can trigger the following warning about dir...
UBUNTU-CVE-2026-53279
In the Linux kernel, the following vulnerability has been resolved: drm/gma500/oaktraillvds: fix hang on init failure The LVDS init code looks up an I2C adapter using i2cgetadapter and tries to read the EDID before falling back to allocating and registering its own adapter. The error handling doe...
EUVD-2026-39856
In the Linux kernel, the following vulnerability has been resolved: iouring/napi: cap busypollto 10 msec Currently there's no cap on the maximum amount of time that napi is allowed to poll if no events are found, which can lead to kernel complaints on a task being stuck as there's no conditional...
CVE-2026-53303
In the Linux kernel, the following vulnerability has been resolved: f2fs: protect extensionlist reading with sblock in f2fssbishow In f2fssbishow, the extensionlist, extensioncount and hotextcount are read without holding sbi-sblock. If a concurrent sysfs store modifies the extension list via...
BELL-CVE-2026-54679
Bulletin has no description...
EUVD-2026-39814
mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.6.1, the mise HTTP backend builds its install symlink destination from the raw resolved version string for non-latest versions. Normal tool install paths use the sanitized version pathname, but the HTTP backend's symlin...
CVE-2026-47206
Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.39.9, Dragonfly has a RESP Protocol Injection via Lua redis.errorreply in EvalSerializer. An authenticated user can inject arbitrary RESP messages into the connection's response stream, potentially causing...
CVE-2026-45406
Technical details are not publicly available in the provided documents; monitor for updates.
DRUPAL-CONTRIB-2026-064
The Tealium iQ Tag Management module provides Drupal integration with Tealium iQ. tealiumiq stores some data as PHP-serialized strings. In some situations, malicious data can be written directly to the field. This can lead to an Object Injection vulnerability when the data are unserialized. This...
CVE-2026-57648
Contributor Broken Access Control in Nelio Content = 4.3.4 versions...
EUVD-2026-39667
Contributor SQL Injection in Contest Gallery = 30.0.0 versions...
CVE-2026-57649
The CVE concerns the WordPress Shoppable Images Lite plugin (versions
EUVD-2026-39750
Contributor Insecure Direct Object References IDOR in PPWP = 1.9.19 versions...
CVE-2026-57321
Contributor Arbitrary File Deletion in H5P = 1.17.7 versions...