1073 matches found
CVE-2025-71237 nilfs2: Fix potential block overflow that cause system hang
In the Linux kernel, the following vulnerability has been resolved: nilfs2: Fix potential block overflow that cause system hang When a user executes the FITRIM command, an underflow can occur when calculating nblocks if endblock is too small. Since nblocks is of type sectort, which is u64, a...
CVE-2026-27177: Improper Neutralization of Input During Web Page Generation
MajorDoMo aka Major Domestic Module contains a stored cross-site scripting XSS vulnerability via the /objects/?op=set endpoint, which is intentionally unauthenticated for IoT device integration. User-supplied property values are stored raw in the database without sanitization. When an administrat...
📄 MongoDB BSON Decompression OP_COMPRESSED Memory Disclosure
This Metasploit module demonstrates an educational memory leak in MongoDB BSON decompression. It sends malformed BSON in OPCOMPRESSED messages to trigger memory disclosure. Quite a huge list of versions are affected...
CVE-2025-61732 vulnerabilities
Vulnerabilities for packages: k8ssandra-operator, gitea, timoni, terraform-provider-time, flannel-cni-plugin, flux-helm-controller, kyverno-notation-aws, checksec, opentelemetry-operator, flux-notification-controller, swagger, timestamp-authority, aws-s3-controller, apache-exporter, guac,...
CVE-2025-68121 vulnerabilities
Vulnerabilities for packages: k8ssandra-operator, timoni, terraform-provider-time, flux-helm-controller, kyverno-notation-aws, opentelemetry-operator, flux-notification-controller, swagger, timestamp-authority, aws-s3-controller, apache-exporter, guac, pvc-autoresizer, caddy, skopeo, cue, tfsec,...
GHSA-8JVR-VH7G-F8GX vulnerabilities
Vulnerabilities for packages: k8ssandra-operator, gitea, timoni, terraform-provider-time, flannel-cni-plugin, flux-helm-controller, kyverno-notation-aws, checksec, opentelemetry-operator, flux-notification-controller, swagger, timestamp-authority, aws-s3-controller, apache-exporter, guac,...
CVE-2025-61732 vulnerabilities
Vulnerabilities for packages: json-exporter-fips, kubeflow-pipelines, percona-xtradb-cluster-operator, kubernetes-csi-driver-nfs, prometheus-fips, kserve-modelmesh-serving, kubernetes-csi-node-driver-registrar-fips, crossplane-provider-aws-cloudfront-fips, kubernetes-csi-livenessprobe-fips,...
GHSA-8JVR-VH7G-F8GX vulnerabilities
Vulnerabilities for packages: json-exporter-fips, kubeflow-pipelines, percona-xtradb-cluster-operator, kubernetes-csi-driver-nfs, prometheus-fips, kserve-modelmesh-serving, kubernetes-csi-node-driver-registrar-fips, crossplane-provider-aws-cloudfront-fips, kubernetes-csi-livenessprobe-fips,...
CVE-2025-68121 vulnerabilities
Vulnerabilities for packages: json-exporter-fips, kubeflow-pipelines, kubernetes-csi-driver-nfs, prometheus-fips, kserve-modelmesh-serving, kubernetes-csi-node-driver-registrar-fips, crossplane-provider-aws-cloudfront-fips, kubernetes-csi-livenessprobe-fips, nfs-subdir-external-provisioner,...
CVE-2026-23109 fs/writeback: skip AS_NO_DATA_INTEGRITY mappings in wait_sb_inodes()
In the Linux kernel, the following vulnerability has been resolved: fs/writeback: skip ASNODATAINTEGRITY mappings in waitsbinodes Above the while loop in waitsbinodes, we document that we must wait for all pages under writeback for data integrity. Consequently, if a mapping, like fuse,...
Op Neusploit: Russian APT28 Uses Microsoft Office Flaw in Malware Attacks
A new campaign by the Russian-linked group APT28, called Op Neusploit, exploits a Microsoft Office flaw to steal emails for remote control of devices in Ukraine, Slovakia, and Romania...
CVE-2026-24775: Insufficient Verification of Data Authenticity
OpenProject is an open-source, web-based project management software. In the new editor for collaborative documents based on BlockNote, OpenProject maintainers added a custom extension in OpenProject version 17.0.0 that allows to mention OpenProject work packages in the document. To show work...
CVE-2021-47851: Improper Neutralization of Special Elements used in an OS Command
Mini Mouse 9.2.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands through an unauthenticated HTTP endpoint. Attackers can leverage the /op=command endpoint to download and execute payloads by sending crafted JSON requests with malicious script...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001672)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001672 advisory. A time-of-check to time-of-use issue exists in iouring subsystem's IORINGOPCLOSE operation in the Linux kernel's versions 5.6 - 5.11 inclusive, which allows a local...
CVE-2020-23588
A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OPV3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack to "Enable or Disable Ports" and to "Change port number" through " /rmtacc.asp "...
CVE-2026-21688 iccDEV has Type Confusion in SIccCalcOp::ArgsPushed() at IccProfLib/IccMpeCalc.cpp
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium ICC color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in SIccCalcOp::ArgsPushed at IccProfLib/IccMpeCalc.cpp. This...
CVE-2025-58436 affecting package cups for versions less than 2.3.3op2-11
CVE-2025-58436 affecting package cups for versions less than 2.3.3op2-11. A patched version of the package is available...
Unity Linux 20.1070e Security Update: kernel (UTSA-2026-000410)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000410 advisory. A flaw was found in Linux Kernel because access to the global variable fgconsole is not properly synchronized leading to a use after free in confontop. Tenable has...
Out-of-bounds Write
Overview Affected versions of this package are vulnerable to Out-of-bounds Write in the opSetSloti32 function of m3exec.h. An attacker can cause memory corruption by manipulating the execution flow locally. Remediation There is no fixed version for pywasm3. References - GitHub Issue - GitHub Issu...
