webp_server_go 0.4.0 - Path Traversal

webpservergo 0.4.0 contains a path traversal caused by insufficient sanitization in file handling, letting attackers read arbitrary files on the server, exploit requires attacker to send crafted requests. id: CVE-2021-46104 info: name: webpservergo 0.4.0 - Path Traversal author: pikpikcu severity...

[SECURITY] Fedora 45 Update: ocaml-psmt2-frontend-0.4.0-33.fc45

This package contains a library to parse and typecheck a conservative extension of the SMT-LIB 2 standard with prenex polymorphism...

CLSA-2026-1790604852 TuxCare security update for minimatch (2 CVEs)

TuxCare rebuilt minimatch to address 2 CVEs. Fixed in 0.4.0-tuxcare.1...

mpp vulnerable to Gas Draining with low gas limit

Vulnerability When the server acts as the fee payer, mpp Elixir 0.4.0 ZenHive/mpp does not validate whether the gaslimit set by the client is enough before broadcasting. A malicious client can drain the server's gas without paying. A transferWithMemo call on Tempo Moderato testnet requires 51,299...

GHSA-QPXH-FF8M-C62V mpp vulnerable to Gas Draining with access list

Details When the server acts as the feepayer, mpp Elixir 0.4.0 copies the client-supplied EIP-2930 access list verbatim into the cosigned fee-payer transaction. In cosignfeepayer, the server re-signs the raw basefields index 5 of the 0x76 AASigned envelope without inspecting the access list field...

mpp vulnerable to Gas Draining with access list

Details When the server acts as the feepayer, mpp Elixir 0.4.0 copies the client-supplied EIP-2930 access list verbatim into the cosigned fee-payer transaction. In cosignfeepayer, the server re-signs the raw basefields index 5 of the 0x76 AASigned envelope without inspecting the access list field...

mpp vulnerable to Gas Draining with no limit

Details When the server acts as the feepayer, the mpp Elixir 0.4.0 does not validate gaslimit, maxfeepergas and maxpriorityfeepergas before cosigning the client's fee-payer transaction. A malicious client embeds arbitrarily large maxfeepergas and maxpriorityfeepergas values in the signed envelope...

openSUSE 16 Security Update : waylyrics (openSUSE-SU-2026:21815-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21815-1 advisory. Changes in waylyrics: - Update to version 0.4.0 CVE-2026-25541 bsc1274106 Added plugin architecture and SakuraLLM translation plugin Added OpenCC suppor...

OPENSUSE-SU-2026:21815-1 Security update for waylyrics

This update for waylyrics fixes the following issues: Changes in waylyrics: - Update to version 0.4.0 CVE-2026-25541 bsc1274106 Added plugin architecture and SakuraLLM translation plugin Added OpenCC support for Simplified/Traditional Chinese Added support for custom CSS themes and style presets...

UBUNTU-CVE-2026-86317

A vulnerability was detected in ggml-org llama.cpp up to 0.4.0. This impacts the function rpcserver::deserializetensor of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component RPC Server. Performing a manipulation of the argument ne results in reachable assertion. The attack is possible to be...

CVE-2026-86317

A vulnerability was detected in ggml-org llama.cpp up to 0.4.0. This impacts the function rpcserver::deserializetensor of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component RPC Server. Performing a manipulation of the argument ne results in reachable assertion. The attack is possible to be...

CVE-2026-82745: Improper Access Control

Improper Access Control vulnerability in ash-project ash lets a create action overwrite an existing record when the ETS or Mnesia data layer is used, because neither enforced primary-key uniqueness on insert. Unlike a SQL data layer, whose unique primary-key constraint rejects a duplicate, the ET...

EUVD-2026-54602

File::Rotate::Simple versions before 0.4.0 for Perl create the target of dangling symlinks when rotating files. When the file to be rotated is a symbolic link to a missing file, and the touch option is enabled, then the rotate method assumes that the file is absent since the existence check is...

CLSA-2026-1780447837 TuxCare security update for cookie (1 CVE)

TuxCare rebuilt cookie to address 1 CVE. Fixed in 0.4.0-tuxcare.1...

CLSA-2026-1776818206 TuxCare security update for jsonwebtoken (2 CVEs)

TuxCare rebuilt jsonwebtoken to address 2 CVEs. Fixed in 0.4.0-tuxcare.6...

CLSA-2026-1774657370 TuxCare security update for jsonwebtoken (2 CVEs)

TuxCare rebuilt jsonwebtoken to address 2 CVEs. Fixed in 0.4.0-tuxcare.1...

CLSA-2026-1773274562 TuxCare security update for tunnel-agent (1 CVE)

TuxCare rebuilt tunnel-agent to address 1 CVE. Fixed in 0.4.0-tuxcare.1...

CLEANSTART-2026-VZ36874 Security fixes in paranoia 0.4.0-r0

Package paranoia version 0.4.0-r0 fixes 9 vulnerabilities: ghsa-p436-gjf2-799p, CVE-2025-15558, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282...

📄 rouille 3.6.2 HTTP Response Splitting

rouille versions 3.6.2 and earlier contain an HTTP response splitting vulnerability due to improper validation of response header values. Applications that place attacker-controlled data into HTTP response headers can inject carriage return and line feed characters, allowing attackers to create...

CVE-2026-66749

Let's Chat 0.4.0 through 0.4.8 contains a null dereference vulnerability that allows authenticated attackers to crash the server by supplying a valid 24-character hex string room parameter that matches no document in the database. Attackers can send a crafted GET /messages request causing an...