167763 matches found
Malicious code in express-nodejs (npm)
Source: amazon-inspector 9aea7dd76028cd443cf2f8d58fa5d8b3b28bb6db870f34d1cc6dad28db92fe93 [email protected] typosquats the express framework: package.json copies express's description, author TJ Holowaychuk, repository expressjs/express, and homepage while publishing under a different name. Th...
Malicious code in exprrdd (npm)
Source: amazon-inspector bc1c956097cd13e80298a796a5026ebd91ece7c2ad53d226d3729f0b0b0ee9f3 Package 'exprrdd' copies express's metadata name-lookalike, description, author, contributors, repository, keywords, dependencies as cover for a preinstall dropper. package.json line 98 declares a preinstall...
Malicious code in express-javascript (npm)
Source: amazon-inspector 73e4909976d37fb7fb7dd30012d82bd882608df20716a824f1dc0efa074b5401 [email protected] impersonates the express package copying its description, author, contributors, repository, homepage, and dependency list verbatim while its package.json preinstall lifecycle hook ru...
USN-8844-1 c-ares vulnerability
It was discovered that c-ares incorrectly handled certain query completion callbacks. An attacker could possibly use this issue to trigger a use- after-free or double-free, resulting in a denial of service or arbitrary code execution...
USN-8844-1: c-ares vulnerability
It was discovered that c-ares incorrectly handled certain query completion callbacks. An attacker could possibly use this issue to trigger a use- after-free or double-free, resulting in a denial of service or arbitrary code execution...
RHLW-2026-07E5370D09E5A6F8 Lightwell Security Advisory: logback-core 1.5.9.rhlw-00031
Red Hat Lightwell has released ch.qos.logback:logback-core 1.5.9.rhlw-00031 with backported fixes for CVE-2024-12798, CVE-2024-12801, CVE-2026-10532, and CVE-2026-19880. CVE-2024-12798: ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto including version 0.1 to 1.3.14 and 1.4.0...
CVE-2026-102566 CTranslate2 before 4.8.1 Heap Buffer Overflow via model.bin
CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails to validate payload length against allocated buffer size. Attackers can craft malicious model files with oversized payload lengths to write past heap allocation boundaries, causing crashes or...
CVE-2026-102566
CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails to validate payload length against allocated buffer size. Attackers can craft malicious model files with oversized payload lengths to write past heap allocation boundaries, causing crashes or...
CVE-2026-102566
CTranslate2 versions prior to 4.8.1 are vulnerable to a heap-based buffer overflow within the binary model loader. The root cause is a failure to validate the payload length against the allocated buffer size when processing model.bin files. An attacker can craft malicious model files with oversiz...
USN-8843-1: FreeIPMI vulnerabilities
It was discovered that FreeIPMI incorrectly handled certain malformed Fujitsu SEL long-text responses, leading to a stack-based buffer overflow. An attacker in control of a malicious IPMI device could possibly use this issue to cause FreeIPMI to crash, resulting in a denial of service, or possibl...
USN-8843-1 freeipmi vulnerabilities
It was discovered that FreeIPMI incorrectly handled certain malformed Fujitsu SEL long-text responses, leading to a stack-based buffer overflow. An attacker in control of a malicious IPMI device could possibly use this issue to cause FreeIPMI to crash, resulting in a denial of service, or possibl...
kernel: eventpoll: fix ep_remove struct eventpoll / struct file UAF
A flaw was found in the Linux kernel's eventpoll mechanism. A Use-After-Free UAF vulnerability, where the system attempts to access memory after it has been freed, can occur during the removal of a file. A local attacker could exploit this race condition to corrupt memory, potentially leading to...
gstreamer-plugins-good: GStreamer: Remote Code Execution via MRF file parsing heap-based buffer overflow
A flaw was found in GStreamer. A remote attacker could exploit a heap-based buffer overflow vulnerability when parsing specially crafted MRF Multimedia Research Forum files. This vulnerability arises from insufficient validation of user-supplied data length before copying it to a heap-based buffe...
CVE-2026-96419
A flaw was found in Wireshark. Due to improper pathname validation during configuration profile imports, an attacker could convince a user to import a maliciously crafted profile. Successful exploitation could allow arbitrary code execution or cause an application crash, resulting in a Denial of...
CVE-2026-19547
A flaw was found in Ghostscript. In Windows environments, the application searches for PostScript resource files in predictable directory paths that do not exist by default. An authenticated local user can exploit this issue by creating the required directory structure and planting a malicious...
CVE-2026-87609
An use after free flaw was found in the Sharing component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/547322272...
AZL-105729 CVE-2026-15390 affecting package qemu 10.1.0-1
Das U-Boot with CONFIGIPDEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execute arbitrary code by sending duplicated last-fragment IP packets. This issue was fixed in commit...
DEBIAN-CVE-2026-15390
Das U-Boot with CONFIGIPDEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execute arbitrary code by sending duplicated last-fragment IP packets. This issue was fixed in commit...
CVE-2026-19547
Ghostscript for Windows is vulnerable to local privilege escalation through PostScript resource file hijacking. Due to the application searching for PostScript resource files in predictable paths under C:\gs\ that do not exist by default on Windows installations, combined with Windows default...
CVE-2026-15390
Das U-Boot with CONFIGIPDEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execute arbitrary code by sending duplicated last-fragment IP packets. This issue was fixed in commit...