EUVD-2026-55320

In the Linux kernel, the following vulnerability has been resolved: media: nxp: imx8-isi: Fix potential out-of-bounds issues The maximum downscaling factor supported by ISI can be up to 16. Add minimum value constraint before applying the setting to hardware. Otherwise, the process will not respo...

C-Lodop Printer Pre-Auth File Read

Reads arbitrary files from C-Lodop print servers using encoded directory traversal in the HTTP URL. !/usr/bin/env python3 -- coding: utf-8 -- """C-Lodop printer pre-auth arbitrary file read via URL path traversal.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient fro...

PT-2026-69923

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description The backup and restore pipeline constructs shell commands by directly interpolating user-controlled database fields into bash -c and sh -c strings, which are then executed via the child process.exe...

Linux Distros Unpatched Vulnerability : CVE-2026-69186

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - c-ares is an asynchronous resolver library. Prior to 1.34.7, aresdnsparse trusts the attacker- controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming...

CVE-2026-6368: Use of Uninitialized Resource

Calling wordexp with WRDEAPPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the wewordv member, which on subsequent calls to wordfree may abort the process...

ALSA-2026:52675 Moderate: libarchive security update

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file...

PT-2026-80175

Name of the Vulnerable Software and Affected Versions c-ares versions prior to 1.34.8-1.1 Description A CPU-exhaustion denial of service occurs due to unbounded DNS name compression pointer chains. This issue allows an attacker to cause excessive CPU usage by providing specially crafted DNS...

PT-2026-69772

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the USB core port handling where the connector unbind function fails to call typec deattach, creating an asymmetry with the connector bind function. When a Thunderbolt...

CVE-2026-68372: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: core: port: Deattach Type-C connector on component unbind connectorunbind is the mirror of connectorbind, but it is missing the symmetric call to typecdeattach that connectorbind makes via: if portdev-child...

Linux Distros Unpatched Vulnerability : CVE-2026-69184

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - c-ares is an asynchronous resolver library. Prior to 1.34.7, aresdnsnameparse enforces backward DNS compression pointers but does not bound the total pointer ho...

PT-2026-80176

Name of the Vulnerable Software and Affected Versions c-ares versions prior to 1.34.8-1.1 Description A memory-amplification denial of service occurs due to unvalidated DNS header record counts. This allows an attacker to cause excessive memory consumption by manipulating the record counts in DNS...

PT-2026-69894

Name of the Vulnerable Software and Affected Versions GNU C Library versions 2.0 through 2.43 Description Calling the wordexp function with the WRDE APPEND flag can cause the interface to return invalid memory within the we wordv member. This condition may lead to a process abort during subsequen...

Photon OS 5.0: C PHSA-2024-5.0-91-0217

An update of the c package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-91-0217. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

MeshCore room-server-v1.17.0

About MeshCore MeshCore is a lightweight, portable C++ library that enables multi-hop packet routing for embedded projects using LoRa and other packet radios. It is designed for developers who want to create resilient, decentralized communication networks that work without the internet. 🔍 What is...

EulerOS 2.0 SP11 : glibc (EulerOS-SA-2026-3066)

According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Calling the scanf family of functions with a %mc malloc'd character match in the GNU C Library version 2.7 to version 2.43 with a format width...

Use After Free

Overview json is a JSON implementation as a Ruby extension in C. Affected versions of this package are vulnerable to Use After Free through JSON::ResumableParserpartialvalue in ext/json/ext/parser/parser.c. An attacker can crash the Ruby process by supplying truncated streaming JSON with duplicat...

Malicious Package

Overview ded-pwa-c-micro is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in ded-pwa-c-mapping (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 111c9e7975f791388e592fc9d4e6b492ce8d7239a902d148a8fc1acf40f0cf18 On require of the package, helpers.js runs a bootstrap routine that selects a platform-specific payload, fetches an opaque native binary over HTTPS...

MAL-2026-13534 Malicious code in ded-pwa-c-boxy-di (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eaf51af402fad446e71b05e085b200e7892ee97e53f8f4593990d7f2b4979037 On require'ded-pwa-c-boxy-di', index.js loads loader.js, which selects a platform-specific remote endpoint hostnames assembled at runtime by joining...

Malicious code in ded-pwa-c-boxy-di (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eaf51af402fad446e71b05e085b200e7892ee97e53f8f4593990d7f2b4979037 On require'ded-pwa-c-boxy-di', index.js loads loader.js, which selects a platform-specific remote endpoint hostnames assembled at runtime by joining...