266088 matches found
PT-2026-102038
Security vulnerability affects the azure-functions-node package. This issue is resolved in later releases. See references for vulnerability details...
CVE-2026-76900: Server-Side Request Forgery (SSRF)
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. In version 1.7.3, ApprovalResourceService.sendWebHook reads WebHookConfig.webHookUrl from stored approval-node configuration and passes it through...
PT-2026-101844
Security vulnerability affects the azure-functions-node package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-95638
Name of the Vulnerable Software and Affected Versions LightLLM versions prior to 1.2.1 Description An authentication bypass exists in the /pd register WebSocket endpoint. Unauthenticated attackers can register arbitrary nodes by providing crafted JSON, as the system fails to perform peer address...
PT-2026-102076
Security vulnerability affects the kubernetes-dns-node-cache-fips package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-100635
Security vulnerability affects the kubernetes-dns-node-cache-fips package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-101440
Security vulnerability affects the azure-functions-node package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-100162
Security vulnerability affects the kubernetes-dns-node-cache package. This issue is resolved in later releases. See references for vulnerability details...
CVE-2026-92708: Exposure of Sensitive Information to an Unauthorized Actor
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing...
CVE-2026-61550: Missing Authorization
Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and...
PT-2026-95695
Name of the Vulnerable Software and Affected Versions Svelte devalue versions 5.1.0 through 5.9.2 Description The stringify and uneval functions serialize typed arrays by emitting the entire backing ArrayBuffer instead of only the view. When serializing a Node Buffer, which uses a process-wide...
PT-2026-102049
Security vulnerability affects the azure-functions-node package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-101517
Security vulnerability affects the azure-functions-node package. This issue is resolved in later releases. See references for vulnerability details...
CVE-2026-54451
Elixir protobuf is a pure Elixir implementation of Google Protobuf. From 0.8.0 until 0.16.1, services that decode attacker-controlled protobuf bytes with Protobuf.Decoder can be taken offline when the schema contains a self-referential or cyclic message type. In lib/protobuf/decoder.ex,...
EUVD-2026-82368
Elixir protobuf is a pure Elixir implementation of Google Protobuf. From 0.8.0 until 0.16.1, services that decode attacker-controlled protobuf bytes with Protobuf.Decoder can be taken offline when the schema contains a self-referential or cyclic message type. In lib/protobuf/decoder.ex,...
CVE-2026-54451 Elixir protobuf: Unbounded recursion depth in embedded-message decoding
Elixir protobuf is a pure Elixir implementation of Google Protobuf. From 0.8.0 until 0.16.1, services that decode attacker-controlled protobuf bytes with Protobuf.Decoder can be taken offline when the schema contains a self-referential or cyclic message type. In lib/protobuf/decoder.ex,...
AZL-102906 CVE-2026-90322 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: ocfs2/cluster: keep heartbeat local node stable o2nmnodelocalstore handles local=0 by stopping o2net and setting cllocalnode to O2NMINVALIDNODENUM, but it leaves clhaslocal set. That stale state makes o2nmthisnode return 255,...
Important: Red Hat Security Advisory: perl-XML-LibXML security update
An update for perl-XML-LibXML is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
SUSE CVE-2026-89802
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix NULL deref unwinding an OPMAPSPARSE op Each bindjobop is zeroed by kzallocobj in bindjobopfromuop, and the OPMAPSPARSE case in nouveauuvmmbindjobsubmit only creates a region, so op-ops stays NULL for a...
SUSE CVE-2026-89982
In the Linux kernel, the following vulnerability has been resolved: i2c: mux: Fix channel node leak on adapter add failure i2cmuxaddadapter takes a reference to the Device Tree channel node before registering the new adapter. If adapter registration fails, the error path frees the private data...