184 matches found
PT-2026-91733
A vulnerability has been found in GPAC 26.07.0. Affected is the function gf sg dom event bubble of the file src/scenegraph/dom events.c of the component MP4Box. The manipulation leads to stack-based buffer overflow. The attack can only be performed from a local environment. The exploit has been...
SUSE CVE-2026-89695
In the Linux kernel, the following vulnerability has been resolved: nfsd: cap decoded POSIX ACL count to bound sort cost nfsd4decodeposixacl reads a u32 entry count off the wire and passes it straight to posixaclalloc and sortpaclrange. The latter is an On^2 bubble sort, so a client-chosen count...
Linux Distros Unpatched Vulnerability : CVE-2026-89695
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfsd: cap decoded POSIX ACL count to bound sort cost nfsd4decodeposixacl reads a u32 entry count off the wire and passes it straight to posixaclalloc and...
DEBIAN-CVE-2026-89695
In the Linux kernel, the following vulnerability has been resolved: nfsd: cap decoded POSIX ACL count to bound sort cost nfsd4decodeposixacl reads a u32 entry count off the wire and passes it straight to posixaclalloc and sortpaclrange. The latter is an On^2 bubble sort, so a client-chosen count...
CVE-2026-89695
In the Linux kernel, the following vulnerability has been resolved: nfsd: cap decoded POSIX ACL count to bound sort cost nfsd4decodeposixacl reads a u32 entry count off the wire and passes it straight to posixaclalloc and sortpaclrange. The latter is an On^2 bubble sort, so a client-chosen count...
CVE-2026-89695 nfsd: cap decoded POSIX ACL count to bound sort cost
In the Linux kernel, the following vulnerability has been resolved: nfsd: cap decoded POSIX ACL count to bound sort cost nfsd4decodeposixacl reads a u32 entry count off the wire and passes it straight to posixaclalloc and sortpaclrange. The latter is an On^2 bubble sort, so a client-chosen count...
EUVD-2026-76607
In the Linux kernel, the following vulnerability has been resolved: nfsd: cap decoded POSIX ACL count to bound sort cost nfsd4decodeposixacl reads a u32 entry count off the wire and passes it straight to posixaclalloc and sortpaclrange. The latter is an On^2 bubble sort, so a client-chosen count...
Malicious code in express-bubble (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 956b35c3b022736d505e63ff195d09af3bfe315d35774c9544de2e3569affab8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious Package
Overview express-bubble is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
MAL-2026-11303 Malicious code in express-bubble (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 956b35c3b022736d505e63ff195d09af3bfe315d35774c9544de2e3569affab8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
GHSA-HQMV-V56G-4M47 Typebot.io has stored XSS via `javascript`: URI in text bubble links — bot author executes JS on visitors' browsers
Summary The Typebot viewer packages/embeds/js renders anchor tags from rich text bubble content without filtering the javascript: URI scheme. A bot author can set a link URL to javascript:PAYLOAD, which executes in the visitor's browser context when clicked. Since the viewer is typically embedded...
CVE-2026-39964 TypeBot: Stored XSS via javascript: URI in text bubble links — bot author executes JS on visitors' browsers
TypeBot is a chatbot builder tool. In versions prior to 3.16.0, the Typebot viewer packages/embeds/js renders anchor tags from rich text bubble content without filtering the javascript: URI scheme. A bot author can set a link URL to javascript:PAYLOAD, which executes in the visitor's browser...
Malicious code in bubble-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bac16503e5a840ccf7e88977f38fac02affaa1c8eaff7f449b9832fa03cbd0a8 The package bubble-core was found to contain malicious code. Source: ghsa-malware a4122cb6b21018902fe682cf3dd31246d52f8850e8116649894d89df6f06acb2 An...
Malicious Package
Overview bubble-core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...
MAL-2026-1104 Malicious code in bubble-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bac16503e5a840ccf7e88977f38fac02affaa1c8eaff7f449b9832fa03cbd0a8 The package bubble-core was found to contain malicious code. Source: ghsa-malware a4122cb6b21018902fe682cf3dd31246d52f8850e8116649894d89df6f06acb2 An...
CVE-2025-14317
In Crazy Bubble Tea mobile application authenticated attacker can obtain personal information about other users by enumerating a loyaltyGuestId parameter. Server does not verify the permissions required to obtain the data. This issue was fixed in version 915 Android and 7.4.1 iOS...
CVE-2025-14317 User Enumeration in Crazy Bubble Tea mobile application
In Crazy Bubble Tea mobile application authenticated attacker can obtain personal information about other users by enumerating a loyaltyGuestId parameter. Server does not verify the permissions required to obtain the data. This issue was fixed in version 915 Android and 7.4.1 iOS...
CVE-2025-14317 User Enumeration in Crazy Bubble Tea mobile application
In Crazy Bubble Tea mobile application authenticated attacker can obtain personal information about other users by enumerating a loyaltyGuestId parameter. Server does not verify the permissions required to obtain the data. This issue was fixed in version 915 Android and 7.4.1 iOS...
CVE-2025-14317: Exposure of Private Personal Information to an Unauthorized Actor
In Crazy Bubble Tea mobile application authenticated attacker can obtain personal information about other users by enumerating a loyaltyGuestId parameter. Server does not verify the permissions required to obtain the data. This issue was fixed in version 915 Android and 7.4.1 iOS...
Crazy Bubble Tea App 安全漏洞
Crazy Bubble Tea App is a Pearl Milk Tea ordering mobile app from Crazy Bubble Tea, Poland. A security vulnerability exists in Crazy Bubble Tea App versions prior to 915 and prior to 7.4.1, which stems from the server not verifying permissions and could lead to the enumeration of the loyaltyGuest...