The-40-Thieves obsidian-tc resource management error vulnerability

Versions 1.0.1 through 1.31.4 of The-40-Thieves obsidian-tc contain a security vulnerability. This vulnerability arises because createentity, linkentities, renameentity, unlinkentities, and deleteentity fail to properly preserve ownership of notes when re-generating memory notes via the path...

The-40-Thieves obsidian-tc authorization issue vulnerability

In versions 1.13.0 through 1.31.4 of The-40-Thieves obsidian-tc, there is an authorization issue vulnerability. This arises in Streamable HTTP deployments where the server misinterprets the bound requestState as a manual approval token. As a result, when a client receives a manual rejection,...

Astra Linux – vulnerability in Imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, when a PCD file does not contain a valid Sync marker, the DecodeImage function becomes trapped in an infinite loop while searching for the Sync marker, causing...

Astra Linux – vulnerability in Imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a stack buffer overflow occurs when processing the an attribute in msl.c. A long value overflows a fixed-size stack buffer, resulting in memory corruption...

Astra Linux – vulnerability in Imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a specially crafted SVG file containing a malicious element caused ImageMagick to attempt allocating approximately 674 GB of memory, resulting in a...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: vfio/platform: check the bounds of read/write syscalls count and offset are passed from user space and not checked; only offset is capped to 40 bits, which can be used to read/write out of bounds of the device...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a malicious MSL script could trigger a heap-use-after-free vulnerability. The operation element handler replaced and freed the image while the parser continued...

Astra Linux – vulnerability in Imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the ps coders responsible for writing PostScript files failed to sanitize the input before writing it into the PostScript header. An attacker can provide a...

CVE-2026-87968

The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin, in versions before 5.3.2 , contains a vulnerability due to a missing nonce or capability check on an AJAX action. This flaw allows unauthenticated users to force a store re-regi...

EUVD-2026-100857

The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2 does not perform a nonce or capability check on the AJAX action that registers the store with its feed service and exposes it to unauthenticated users, so any visito...

CVE-2026-87968: Improper Access Control

The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2 does not perform a nonce or capability check on the AJAX action that registers the store with its feed service and exposes it to unauthenticated users, so any visito...

The-40-Thieves obsidian-tc information leakage vulnerability

The The-40-Thieves obsidian-tc version prior to 1.3.1 has security vulnerabilities. These vulnerabilities stem from the bridge tool not applying a read access control list to each returned field consistently. The tasksfilter tool exposes the group count for notes that are denied access. The...

The-40-Thieves obsidian-tc backend link vulnerability

The The-40-Thieves obsidian-tc versions before 1.3.1 have a security vulnerability. This vulnerability stems from reading the access control list, where the check for lexical paths includes checking resolved paths as well. This allows symbolic links within libraries that are allowed by wildcarded...

[SECURITY] Fedora 45 Update: libxml++40-4.4.0-3.fc45

libxml++ is a C++ wrapper for the libxml2 XML parser library. Its original author is Ari Johnson and it is currently maintained by Christophe de Vienne and Murray Cumming...

Malicious code in lia-40 (npm)

Source: amazon-inspector 00757010b030278ccf82174c83e8d774c8825a494fb7cb4f15abdb5e16d2cd36 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in kentung-40 (npm)

Source: amazon-inspector 1640dd5d007752f05c3b1cec429c092137ecf81811f23643867d119f2b51b181 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a logic error in the YUV sampling factor validation allowed an invalid sampling factor to bypass checks and trigger a division-by-zero during image loading,...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Before versions 7.1.2-15 and 6.9.13-40, msl.c sometimes failed to update the stack index. As a result, an image might be stored in the wrong slot and never freed upon an error, leading to leaks. Version...

Malicious code in ita-40 (npm)

Source: amazon-inspector 2e74bf7628a17f0adce99a25ab0bdbe4cf0e36362e3e048436fee6b18d3e8987 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in ira-40 (npm)

Source: amazon-inspector 00d274c8e67d49031e9a58fcccd6adb5ec3995e8e87a36a67fb9bd1e89d55958 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...