Unity Linux 20.1050e Security Update: kernel (UTSA-2026-006574)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006574 advisory. In the Linux kernel, the following vulnerability has been resolved: ext2: Check block size validity during mount Check that log of block size stored in the superbloc...

CVE-2026-39356

Drizzle is a modern TypeScript ORM. Prior to 0.45.2 and 1.0.0-beta.20, Drizzle ORM improperly escaped quoted SQL identifiers in its dialect-specific escapeName implementations. In affected versions, embedded identifier delimiters were not escaped before the identifier was wrapped in quotes or...

CVE-2026-39356 SQL Injection via escapeName() in all Drizzle ORM SQL dialects

Drizzle is a modern TypeScript ORM. Prior to 0.45.2 and 1.0.0-beta.20, Drizzle ORM improperly escaped quoted SQL identifiers in its dialect-specific escapeName implementations. In affected versions, embedded identifier delimiters were not escaped before the identifier was wrapped in quotes or...

BIT-NODE-2026-21715

A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync.native without the required read permission checks, while all comparable filesystem functions correctly enforce them. As a result, code running under --permission with restricted --allow-fs-read can still use...

CVE-2025-43405

creationtimestamp| type| source ---|---|--- 2026-04-02 22:20:32+00:00| seen| Telegram/wWHvFepuomphlvUrhwS7vzUP2t5qXRFryLArMmzBGR2vgG4...

CVE-2025-43413

creationtimestamp| type| source ---|---|--- 2026-04-02 22:20:32+00:00| seen| Telegram/wWHvFepuomphlvUrhwS7vzUP2t5qXRFryLArMmzBGR2vgG4...

CVE-2025-43361

creationtimestamp| type| source ---|---|--- 2026-04-02 22:20:13+00:00| seen| Telegram/UFEpGV2QWu8Wd6S6IqU1LkqCMTnXzKbx5ZEOiNlH4x5jKhQ...

GHSA-68P4-J234-43MV

creationtimestamp| type| source ---|---|--- 2026-03-31 23:20:56+00:00| seen| Telegram/8TNuFRjRJBw5r6zwiOXWdT-cqnzTtiBnsbsFB7NS1OTWS8...

CVE-2026-4800

creationtimestamp| type| source ---|---|--- 2026-03-31 20:07:29+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3miey44uyhk2f 2026-03-31 21:19:34+00:00| seen| Telegram/OA0BhF0tC6EPmRi9BAj0aaRm3q83l75bwQVc9b2koDj48CY 2026-04-01 05:05:35+00:00| seen|...

EUVD-2026-17174

A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior...

ALPINE-CVE-2026-21713

A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior...

UBUNTU-CVE-2026-21713

A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior...

CVE-2026-21713

A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior...

Node.js 安全漏洞

Node.js is an open-source, cross-platform JavaScript runtime environment developed by the Node.js community. Versions 20.x, 22.x, 24.x, and 25.x of Node.js have security vulnerabilities. These vulnerabilities stem from HMAC verification using a comparison that does not maintain constant time, whi...

CVE-2026-5007

creationtimestamp| type| source ---|---|--- 2026-03-28 20:10:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mi5gu4g5pn2i...

CVE-2026-4519 affecting package python3 for versions less than 3.9.19-20

CVE-2026-4519 affecting package python3 for versions less than 3.9.19-20. A patched version of the package is available...

CVE-2026-26213

creationtimestamp| type| source ---|---|--- 2026-03-26 21:36:23+00:00| seen| Telegram/qpJXIfLucPvhQtEDSHE7IdszXR3MHRZbZWkV9-ESfqWxnI 2026-03-26 23:11:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhyq2cru5l2d...

CVE-2026-32878

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.20 and 8.6.44, an attacker can bypass the default request keyword denylist protection and the class-level permission for adding fields by sending a crafted request that...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: busybox (UTSA-2026-006298)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006298 advisory. A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: glibc (UTSA-2026-006299)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006299 advisory. Calling getnetbyaddr or getnetbyaddrr with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued network in...