9944 matches found
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconncount – increased the connection cleanup limit to 64. After the optimization to perform only one garbage collection per jiffy, a new problem emerged. If more than 8 new connections are tracked per jiffy, the list...
Malicious code in na-rony-test-karem (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cd6a8602ce62a88124613cbe7eb85e19a1ae122a0ee98c71676fe4969359888f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
The vulnerability of the Merge() function in the Gogs automated Git repository creation tool allows a hacker to execute arbitrary code.
The vulnerability of the Merge function in the Gogs automated Git repository creation tool is related to the lack of measures taken at the control level to clean up data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
The vulnerability of the net/netfilter/ipset component of the Linux operating system, which allows a hacker to cause a service failure.
The vulnerability of the net/netfilter/ipset component of the Linux operating system’s kernel is related to incomplete cleanup of temporary or auxiliary resources. Exploiting this vulnerability can allow an attacker to cause a service failure...
GHSA-3G4Q-2F67-2GVH netfoil has a resource leak in LRU cache
Summary When an entry was removed from the LRU cache, a pointer to the removed element was not properly cleaned up. Impact A local attacker can get netfoil to use more memory. By default this is limited to 100MB via systemd, which would trigger service restarts when reached...
CVE-2026-6101
The CVE-2026-6101 entry affects the AMP for WP – Accelerated Mobile Pages WordPress plugin (versions up to and including 1.1.12). The vulnerability arises from unsafe ZIP extraction in ampforwp_save_local_font() plus inadequate cleanup that omits removal of nested directories/files, enabling auth...
MAL-2026-6949 Malicious code in vps-adapter-core (npm)
The package 'vps-adapter-core' is a purpose-built malware package published by the npm account 'srm0rgan' [email protected] as part of a coordinated campaign of fake 'Paperclip' VPS-maintenance adapters siblings: paperclip2, vps-maintenance, vps-maintenance-paperclip-adapter, paperclip-host-util...
CVE-2026-53646 FOSSBilling: Client password reset token reuse allows persistent account takeover
FOSSBilling is a free, open-source billing and client management system. In versions 0.5.6 through 0.7.2, when a ClientPasswordReset record already exists for a client from a previous unexpired reset request, subsequent calls to the resetpassword guest API endpoint reuse the existing token instea...
EUVD-2026-25004
mknod: Device nodes created mislabeled on SELinux, with broken cleanup removedir on a node...
GHSA-R9HW-MJ3W-PHCQ mknod: Device nodes created mislabeled on SELinux, with broken cleanup (remove_dir on a node)
uutils calls mknod before setting the SELinux context GNU uses setfscreatecon first, labeling atomically. If setselinuxsecuritycontext fails, cleanup uses std::fs::removedir, which cannot remove device nodes or FIFOs, leaving the mislabeled node behind. Impact: on SELinux-enforcing systems the no...
UBUNTU-CVE-2026-42546
OP-TEE is a Trusted Execution Environment TEE designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.3.0 and prior to version 4.11.0, a resource leak exists in OP-TEE’s shared memory cleanup logic because the functio...
CVE-2026-42546
OP-TEE (Trusted Execution Environment for Arm TrustZone) prior to version 4.11.0 contains a resource leak in the shared memory cleanup path. Specifically, cleanup_shm_refs() in core/tee/entry_std.c fails to apply the OPTEE_MSG_ATTR_TYPE_MASK to parameter attributes when processing non-contiguous ...
CVE-2026-42546
OP-TEE is a Trusted Execution Environment TEE designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.3.0 and prior to version 4.11.0, a resource leak exists in OP-TEE’s shared memory cleanup logic because the functio...
CVE-2026-42546
OP-TEE is a Trusted Execution Environment TEE designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.3.0 and prior to version 4.11.0, a resource leak exists in OP-TEE’s shared memory cleanup logic because the functio...
MAL-2026-6871 Malicious code in renderctx (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cbdcdb9e0c6002d228035d5d746f734a23c224429a18e078a44e5fa65db495f7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in react-next-dom (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e7369fd2dd1ba9002d2c693ba08c553c7c6fef54dba372146c11f20b43607aa react-next-dom masquerades as a React/Next.js ecosystem package but ships a pino-like surface concealing a remote code loader. The main export is a...
PT-2026-55975
Name of the Vulnerable Software and Affected Versions OP-TEE versions 3.3.0 through 4.10.x Description A resource leak exists in the shared memory cleanup logic of OP-TEE, a Trusted Execution Environment designed for Arm Cortex-A cores using TrustZone technology. The function cleanup shm refs in...
Use After Free
Overview Affected versions of this package are vulnerable to Use After Free in the curleasycleanup process after configuring an HTTP/2 stream-dependency tree using CURLOPTSTREAMDEPENDS or CURLOPTSTREAMDEPENDSE and invoking curleasyreset. An attacker can cause the application to access freed memor...
