266062 matches found
Astra Linux – Vulnerability in Node-Elliptic
The ECDSA implementation of the Elliptic package generates incorrect signatures if the intermediate value ‘k’ calculated based on step 3.2 of RFC 6979 https://datatracker.ietf.org/doc/html/rfc6979 has leading zeros and is susceptible to cryptanalysis, which can lead to the exposure of the secret...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: f2fs: fixed the issue of detecting potentially corrupted nid entries in freenidlist. According to reports, the disk-related footer.ino and footer.nid files are identical and outside the acceptable range. Therefore, we need to add...
Astra Linux – Vulnerability in node-minimatch
Minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and earlier are vulnerable to Regular Expression Denial of Service ReDoS when a glob pattern contains many consecutive wildcards followed by a literal character that does not...
Astra Linux – Vulnerability in Node.js
A memory leak could occur when a remote peer abruptly closes the socket without sending a “GOAWAY” notification. Additionally, if an invalid header is detected by nghttp2, causing the connection to be terminated by the peer, the same memory leak will be triggered. This flaw could lead to increase...
[SECURITY] [DLA 4820-1] node-lodash security update
----------------------------------------------------------------------- Debian LTS Advisory DLA-4820-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta October 05, 2026 https://wiki.debian.org/LTS -...
Debian dla-4820 : libjs-lodash - security update
The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4820 advisory. - ----------------------------------------------------------------------- Debian LTS Advisory DLA-4820-1 [email protected]...
Malicious code in ultimate-websocket (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7574e423b830695141ee6e089006e0c355109e240c69881512806869cfee8114 package.json declares its only dependency node-net-pool as a bare tarball URL pointing at the mutable main branch of an unrelated GitHub user...
MAL-2026-17529 Malicious code in ultimate-websocket (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7574e423b830695141ee6e089006e0c355109e240c69881512806869cfee8114 package.json declares its only dependency node-net-pool as a bare tarball URL pointing at the mutable main branch of an unrelated GitHub user...
CLSA-2026-1791028051 TuxCare security update for node-forge (3 CVEs)
TuxCare rebuilt node-forge to address 3 CVEs. Fixed in 1.3.1-tuxcare.1...
[SECURITY] Fedora 45 Update: perl-RDF-Trine-Node-Literal-XML-0.16-23.fc45
This Perl module encapsulates XML literals into RDF objects...
@nx/express (>=23.0.0, <=23.1.0), @nx/nest (>=23.0.0, <=23.1.0) +1 more potentially affected by CVE-2026-104859 via @nx/docker (>=23.0.0, <=23.1.0)
@nx/docker NPM version =23.0.0, =23.0.0, =23.0.0, =23.0.0, =23.1.0 Source cves: CVE-2026-104859 Source advisory: SNYK:JS-NXDOCKER-20417215...
CVE-2026-104871
The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for versions 17 through 18, accepts a relative request URL containi...
@nx/express (>=23.0.0, <=23.1.0), @nx/nest (>=23.0.0, <=23.1.0) +1 more potentially affected by CVE-2026-104859 via @nx/docker (>=23.0.0, <=23.1.0)
@nx/docker NPM version =23.0.0, =23.0.0, =23.0.0, =23.0.0, =23.1.0 Source cves: CVE-2026-104859 Source advisory: MEND:CVE-2026-104859...
CVE-2026-104428
The getblock RPC method in zebra-rpc before 11.0.0, used by the Zcash Foundation's Zebra node, panics on verbosity 2 for a side-chain block because the block's -1 confirmations sentinel is converted to u32 with .expect, aborting the process. Remote unauthenticated attackers, directly or through...
CVE-2026-104427
Zebra before 6.1.0 contains an incomplete cleanup vulnerability in the state write task that allows remote unauthenticated peers to stall node synchronization by poisoning parenterrormap. Attackers can deliver a coinbase-malleated block sharing a canonical block's hash before it propagates, causi...
CVE-2026-104426
Zebra before 6.1.0 contains an inefficient algorithmic complexity vulnerability in remainingtransactionvalue that clones the entire block-level spent-UTXO map per transaction during contextual verification. Attackers can mine or seed the mempool with roughly 26,000 minimal single-input transactio...
CVE-2026-104427
Zebra versions before 6.1.0 are vulnerable to an incomplete cleanup vulnerability within the state write task . This flaw allows remote unauthenticated peers to stall node synchronization by poisoning the parent_error_map . Specifically, an attacker can deliver a coinbase-malleated block that sha...
CVE-2026-104427 Zebra before 6.1.0 Chain Stall via Stale parent_error_map Entry
Zebra before 6.1.0 contains an incomplete cleanup vulnerability in the state write task that allows remote unauthenticated peers to stall node synchronization by poisoning parenterrormap. Attackers can deliver a coinbase-malleated block sharing a canonical block's hash before it propagates, causi...
CVE-2026-104427 Zebra before 6.1.0 Chain Stall via Stale parent_error_map Entry
Zebra before 6.1.0 contains an incomplete cleanup vulnerability in the state write task that allows remote unauthenticated peers to stall node synchronization by poisoning parenterrormap. Attackers can deliver a coinbase-malleated block sharing a canonical block's hash before it propagates, causi...
EUVD-2026-91437
Zebra before 6.1.0 contains an inefficient algorithmic complexity vulnerability in remainingtransactionvalue that clones the entire block-level spent-UTXO map per transaction during contextual verification. Attackers can mine or seed the mempool with roughly 26,000 minimal single-input transactio...