CVE-2026-45820

fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync. A crafted ZIP archive with a central directory entry declaring compressedsize=0xFFFFFFFF ZIP64 sentinel but missing the required ZIP64 extra field tag 0x0001 causes z64e to loop indefinitely due to...

CVE-2026-45820

fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync. A crafted ZIP archive with a central directory entry declaring compressedsize=0xFFFFFFFF ZIP64 sentinel but missing the required ZIP64 extra field tag 0x0001 causes z64e to loop indefinitely due to...

ROS-20260722-73-0016

The vulnerability of the Preload function in Google Chrome and Microsoft Edge is related to a violation of data protection mechanisms. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information through a specially created HTML pag...

The vulnerability of the function nvme_ctrl_dhchap_ctrl_secret_store() in the driver/nvme/host/core.c file of the Linux operating system’s NVME kernel driver, which allows a hacker to cause a service failure.

The vulnerability of the nvmectrldhchapctrlsecretstore function in the drivers/nvme/host/core.c file of the Linux NVME driver is related to improper memory release memory leak. Exploiting this vulnerability could allow an attacker to cause a system failure...

The vulnerability of the ext4_mb_use_preallocated() function in the fs/ext4/mballoc.c module of the Ext4 file system in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the ext4mbusepreallocated function in the fs/ext4/mballoc.c file of the Ext4 file system in the Linux operating system is related to the distribution of resources without any restrictions or regulations. Exploiting this vulnerability could allow an attacker to compromise the...

The vulnerability of the sdio_release_func() function in the drivers/mmc/core/sdio_bus.c file of the MMC/SD/SDIO card driver module in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the sdioreleasefunc function in the drivers/mmc/core/sdiobus.c file of the MMC/SD/SDIO card driver for the Linux operating system is related to errors during the update of the link counters. Exploiting this vulnerability could allow an attacker to compromise the...

PT-2026-63553

Name of the Vulnerable Software and Affected Versions Dompdf versions prior to 3.16 Description Dompdf fails to validate the dimensions of BMP images before processing them. The software relies solely on the declared header dimensions to allocate memory for the image canvas via the...

PT-2026-63515

Name of the Vulnerable Software and Affected Versions Protegent 360 version 2.0.0.4 Description A local attacker can escalate privileges through the sub 186f4 function. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability...

PT-2026-63513

Name of the Vulnerable Software and Affected Versions Protegent 360 version 2.0.0.4 Description A local attacker can cause a denial of service through the sub 13828 function. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability...

CVE-2026-38763

An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to cause a denial of service via the function sub13828...

PT-2026-63375

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions prior to 1.25.2 Description Applications using libunbound configured with the unwanted-reply-threshold parameter may be abruptly terminated. This occurs when the threshold is reached and libunbound attempts to call...

CVE-2026-16489

A vulnerability was identified in jsforce up to 3.10.16. This issue affects the function execCommand in the library lib/registry/sfdx.js of the component SFDX Connection Registry. The manipulation leads to os command injection. The attack can only be performed from a local environment. The exploi...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the Open function, which uses raw http.Get and os.Open without proper host or scheme validation. An attacker can access internal network resources, cloud metadata endpoints, or read arbitrary local...

CVE-2026-63923

A flaw was found in the Linux kernel's octeontx2-af driver. A malicious Virtual Function VF attached to a Physical Function PF in switchdev representor mode can send a specially crafted REPEVENTNOTIFY message. This message contains an unvalidated pcifunc field, which can lead to an out-of-bounds...

CVE-2026-47667

CImg Library is a C++ library for image processing. Prior to version 4.0.0 in loadanalyze, the headersize field is read as an unsigned int from the first 4 bytes of an Analyze/NIfTI file and passed directly to new unsigned charheadersize without being bounded against the actual file size. A value...

CVE-2026-47667 CImg Library: Uncontrolled Memory Allocation and Memory Leak in `_load_analyze()` via Crafted NIfTI/Analyze Header

CImg Library is a C++ library for image processing. Prior to version 4.0.0 in loadanalyze, the headersize field is read as an unsigned int from the first 4 bytes of an Analyze/NIfTI file and passed directly to new unsigned charheadersize without being bounded against the actual file size. A value...

CVE-2026-47667

CImg Library is a C++ library for image processing. Prior to version 4.0.0 in loadanalyze, the headersize field is read as an unsigned int from the first 4 bytes of an Analyze/NIfTI file and passed directly to new unsigned charheadersize without being bounded against the actual file size. A value...

GHSA-VCRF-J523-4MRF aws-cdk-lib: OS Command Injection in NodejsFunction Docker Bundling

Summary AWS CDK aws-cdk-lib is an open-source framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation. OS command injection issue in the NodejsFunction Docker bundling pipeline in aws-cdk-lib before 2.260.0 that might allow an actor who controls dependen...

EUVD-2026-41125

aws-cdk-lib: OS Command Injection in NodejsFunction Docker Bundling...

GHSA-W62V-XXXG-MG59 Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility

Summary cx in hono/css composes class names from plain strings but marks the result as already-escaped without HTML-escaping the input. When the result is used as a JSX class attribute during server-side rendering, the value is written into the attribute unescaped, so untrusted input can break ou...