DEBIAN-CVE-2026-3219

pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds wit...

10minions-engine (>=0.0.1, <=0.0.4), @0xr404/lol404 (>=1.1.0, <=1.1.6) +3346 more potentially affected by CVE-2026-41242 via protobufjs (>=7.0.0, <=7.5.4)

protobufjs NPM version =7.0.0, =0.0.1, =1.1.0, =1.0.1-beta.0, =0.0.2-beta.0, =1.0.0, =1.5.10, =0.10.1, =1.1.0, =6.0.0, =2.0.2, =3.3.3 and more Source cves: CVE-2026-41242 Source advisory: SNYK:JS-PROTOBUFJS-16094665...

DEBIAN-CVE-2026-2921

GStreamer RIFF Palette Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending o...

4game-support-ckeditor5-custom-build (>=0.0.1, <=0.0.5), 87-midnight-ckeditor5 (>=0.0.3, <=0.0.5) +668 more potentially affected by CVE-2026-28343 via @ckeditor/ckeditor5-html-support (>=29.2.0, <=47.5.0-alpha.8)

@ckeditor/ckeditor5-html-support NPM version =29.2.0, =0.0.1, =0.0.3, =0.0.1, =3.0.8, =0.0.1, =42.0.1, =2.0.0, =0.7.0, =0.0.6, =1.0.1, =0.0.1, =0.0.1, =1.0.0, =36.0.0, =0.0.2, =0.0.31 and more Source cves: CVE-2026-28343 Source advisory: OSV:GHSA-JRQM-VMQC-GM93...

@budibase/server (>=3.32.1, <=3.38.1), @builders-of-stuff/svelte-sui-wallet-adapter (>=0.6.6, <=2.1.0) +52 more potentially affected by CVE-2026-27125 via svelte (>=5.0.0, <=5.51.2)

svelte NPM version =5.0.0, =3.32.1, =0.6.6, =4.0.0-alpha.1, =4.0.0-alpha.1, =0.1.0, =0.0.1, =1.3.0, =0.1.4, =0.0.20, =0.15.0-beta.2, =1.1.0-beta.0, =5.0.0-next.80, =0.1.1-alpha.24, =0.1.3-next.2 and more Source cves: CVE-2026-27125 Source advisory: SNYK:JS-SVELTE-15322714...

DEBIAN-CVE-2026-23059

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Sanitize payload size to prevent member overflow In qla27xxcopyfpinpkt and qla27xxcopymultiplepkt, the framesize reported by firmware is used to calculate the copy length into item-iocb. However, the iocb member is...

BELL-CVE-2025-71138

Bulletin has no description...

DEBIAN-CVE-2025-13014

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Firefox ESR 115.30, Thunderbird 145, and Thunderbird 140.5...

CVE-2023-30669

Out-of-bounds Write in DoOemFactorySendFactoryTestResult of libsec-ril prior to SMR Jul-2023 Release 1 allows local attacker to execute arbitrary code...

0xkobold (>=0.5.0, <=0.8.0), @0xdwong/html-to-markdown (>=1.0.0, <=1.0.1) +403 more potentially affected by CVE-2025-2792 via @mozilla/readability (>=0.3.0, <=0.5.0)

@mozilla/readability NPM version =0.3.0, =0.5.0, =1.0.0, =0.1.1, =0.1.1, =0.1.1, =0.1.0, =1.0.0, =0.1.0, =0.0.1, =1.0.0, =0.2.0, =0.1.0, =1.6.0, =0.1.5-alpha.0, =0.1.6 and more Source cves: CVE-2025-2792 Source advisory: OSV:GHSA-3P6V-HRG8-8QJ7...

CVE-2024-10387

CVE-2024-10387 IMPACT A Denial-of-Service vulnerability exists in the affected product. The vulnerability could allow a threat actor with network access to send crafted messages to the device, potentially resulting in Denial-of-Service...

CVE-2024-6679

A vulnerability classified as critical has been found in witmy my-springsecurity-plus up to 2024-07-04. Affected is an unknown function of the file /api/role. The manipulation of the argument params.dataScope leads to sql injection. It is possible to launch the attack remotely. The exploit has be...

CVE-2023-40642

In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed...

BELL-CVE-2021-4193 CVE-2021-4193 does not affect BellSoft software

Bulletin has no description...

PT-2022-3561 · Google +1 · Google-Oauth-Java-Client +1

Name of the Vulnerable Software and Affected Versions: google-oauth-java-client versions prior to 1.33.3 Description: The vulnerability is related to the IDToken verifier not verifying if a token is properly signed. This allows an attacker to provide a compromised token with a custom payload, whi...

cmark-gfm 输入验证错误漏洞

cmark-gfm is an extended version of the C-reference implementation of CommonMark, a rationalized version with canonical Markdown syntax. cmark-gfm suffers from an input validation error vulnerability that could be exploited by an attacker to cause remote code execution in applications using the...

3m5-coco (>=0.0.2, <=0.0.981), @24hr/sentry-logger-node (>=0.4.0, <=1.2.2) +278 more potentially affected by CVE-2021-23624 via dotty (>=0.0.1, <=0.1.1)

dotty NPM version =0.0.1, =0.0.2, =0.4.0, =1.1.4, =0.0.2, =1.15.3, =0.1.0, =0.1.6, =1.0.4, =0.1.6, =0.1.0, =1.0.0, =1.0.0, =1.0.7 - @kikiemz/komzpol 1.1.2 and more Source cves: CVE-2021-23624 Source advisory: OSV:GHSA-6G47-63MV-QPGH...

CVE-2021-40104

An issue was discovered in Concrete CMS through 8.5.5. There is an SVG sanitizer bypass...

CVE-2018-20340

Yubico libu2f-host 1.1.6 contains unchecked buffers in devs.c, which could enable a malicious token to exploit a buffer overflow. An attacker could use this to attempt to execute malicious code using a crafted USB device masquerading as a security token on a computer where the affected library is...

Libav Denial of Service Vulnerability (CNVD-2016-12212)

Libav is a cross-platform open source video and audio recording, conversion of a set of solutions . A denial of service vulnerability exists in Libav. An attacker can exploit this vulnerability to cause a denial of service by crashing an application that uses an affected library file...