Malicious Package

Overview cors-base is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

389-ds-base DoS

The vulnerability of the 389-ds-base package for Debian GNU/Linux and Red Hat Enterprise Linux relates to the use of a zero pointer. Exploiting this vulnerability could allow an attacker, operating remotely, to cause service interruptions...

Linux Kernel DoS

The vulnerabilities of the functions bindinterdomainevtchntoirqlateeoi, findvirq, and bindvirqtoirq drivers/xen/events/eventsbase.c in the Linux kernel are related to resource management errors. Exploiting these vulnerabilities can allow an attacker to cause service failures...

CVE-2026-0838

A security flaw has been discovered in UTT 进取 520W 1.7.7-180627. This impacts the function strcpy of the file /goform/ConfigWirelessBase. Performing a manipulation of the argument ssid results in buffer overflow. The attack is possible to be carried out remotely. The exploit has been released to...

CVE-2026-0838 UTT 进取 520W ConfigWirelessBase strcpy buffer overflow

A security flaw has been discovered in UTT 进取 520W 1.7.7-180627. This impacts the function strcpy of the file /goform/ConfigWirelessBase. Performing a manipulation of the argument ssid results in buffer overflow. The attack is possible to be carried out remotely. The exploit has been released to...

UTT 520W security vulnerability

The UTT 520W is a wireless router from China Aitai UTT. A security vulnerability exists in the UTT 520W version 1.7.7-180627, which originates from a buffer overflow in the operation of the function strcpy on the parameter ssid in the file /goform/ConfigWirelessBase, which could lead to the...

SUSE SLES12: libpng16-16 / libpng16-16-32bit / libpng16-compat-devel / etc (SUSE-SU-2026:0085-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:0085-1 advisory. - CVE-2025-66293: out-of-bounds read of the pngsRGBbase array when processing palette PNG images with partial transparency and gamma correction...

@cocoar/scenar-cli (>=0.1.0-beta.54, <=0.1.0-beta.68), @eui/deps-base (>=21.0.0-alpha.10, <=21.0.3-snapshot-1768918434957) +2 more potentially affected by CVE-2026-22610 via @angular/core (>=21.0.0-next.1, <=21.0.6)

@angular/core NPM version =21.0.0-next.1, =0.1.0-beta.54, =21.0.0-alpha.10, =21.0.0-alpha.10, =21.0.3-snapshot-1768918434957 - zax-dashboard 1.0.14 Source cves: CVE-2026-22610 Source advisory: OSV:GHSA-JRMJ-C5CX-3CW6...

@cocoar/scenar-cli (>=0.1.0-beta.54, <=0.1.0-beta.68), @eui/deps-base (>=21.0.0-alpha.10, <=21.0.3-snapshot-1768918434957) +2 more potentially affected by CVE-2026-22610 via @angular/core (>=21.0.0-next.1, <=21.0.6)

@angular/core NPM version =21.0.0-next.1, =0.1.0-beta.54, =21.0.0-alpha.10, =21.0.0-alpha.10, =21.0.3-snapshot-1768918434957 - zax-dashboard 1.0.14 Source cves: CVE-2026-22610 Source advisory: GHSA-JRMJ-C5CX-3CW6...

Security update for libpng16

This update for libpng16 fixes the following issues: CVE-2025-66293: out-of-bounds read of the pngsRGBbase array when processing palette PNG images with partial transparency and gamma correction bsc1254480. Patch Instructions: To install this SUSE update use the SUSE recommended installation...

CVE-2023-25141

Apache Sling JCR Base 3.1.12 has a critical injection vulnerability when running on old JDK versions JDK 1.8.191 or earlier through utility functions in RepositoryAccessor. The functions getRepository and getRepositoryFromURL allow an application to access data stored in a remote location via JDN...

CVE-2023-40955

A SQL injection vulnerability in Didotech srl Engineering & Lifecycle Management aka pdm v.14.0, v.15.0 and v.16.0 fixed in pdm-14.0.1.0.0, pdm-15.0.1.0.0, and pdm-16.0.1.0.0 allows a remote authenticated attacker to execute arbitrary code via the select parameter in models/baseclient.py componen...

CVE-2009-4804

Cross-site scripting XSS vulnerability in the Calendar Base cal extension before 1.1.1 for TYPO3, when Internet Explorer 6 is used, allows remote attackers to inject arbitrary web script or HTML via "search parameters."...

CVE-2009-4158

SQL injection vulnerability in the Calendar Base cal extension before 1.2.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2010-0834

The base-files package before 5.0.0ubuntu7.1 on Ubuntu 9.10 and before 5.0.0ubuntu20.10.04.2 on Ubuntu 10.04 LTS, as shipped on Dell Latitude 2110 netbooks, does not require authentication for package installation, which allows remote archive servers and man-in-the-middle attackers to execute...

CVE-2021-22047

In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for...

CVE-2017-12647

XSS exists in Liferay Portal before 7.0 CE GA4 via a Knowledge Base article title...

CVE-2019-2676

Vulnerability in the Oracle CRM Technical Foundation component of Oracle E-Business Suite subcomponent: Preferences. Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with network...

CVE-2019-2673

Vulnerability in the Oracle Marketing component of Oracle E-Business Suite subcomponent: Marketing Administration. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker...

CVE-2019-2611

Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware subcomponent: Outside In Filters. Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...