12865 matches found
CVE-2026-41872
CVE-2026-41872 affects the “Kura Sushi Official App” from EPG, Inc. via improper certificate validation, enabling a network-based MITM on the push-notification channel. This could allow eavesdropping or alteration of push messages between the app and its server. The CVSS data indicate HIGH impact...
CVE-2026-41872
"Kura Sushi Official App" provided by EPG, Inc. is vulnerable to improper certificate validation. A man-in-the-middle attack may allow eavesdropping on, or altering, the communication on push notifications between the affected application and the relevant server...
Malicious code in hedwig-tsconfig (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1a650b67b76184573f147a7b286249b1de734cfa85647aea9a9bea3284e155f8 The OpenSSF Package Analysis project identified 'hedwig-tsconfig' @ 99.8.1 npm as malicious. It is considered malicious because: - The package...
MiracleLinux 9 : systemd-252-55.el9_7.9.ML.1 (AXSA:2026-609:06)
The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-609:06 advisory. systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data CVE-2026-29111 Tenable has extracted the preceding description...
PT-2026-39984
Name of the Vulnerable Software and Affected Versions Siemens SIMATIC affected versions not specified Description Devices fail to properly validate and sanitize the PLC/station name rendered on the "communication" parameters page of the web interface. An authenticated attacker with authorization ...
MAL-2026-3423 Malicious code in byvendors (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d3ae01e4f5473c61cf7c26fdf51f64fa34c7f16451ce6c093a52fd85b79eff5 The package byvendors was found to contain malicious code. Source: ossf-package-analysis...
firefox: thunderbird: Incorrect boundary conditions in the WebRTC component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the WebRTC component...
firefox: thunderbird: Use-after-free in the WebRTC component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the WebRTC component...
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS CVE-2026-6772 firefox: thunderbird: Use-after-free in the JavaScript Engine component CVE-2026-6754 firefox: thunderbird: Spoofing...
CVE-2026-45179
Plack::Middleware::Statsd versions before 0.9.0 for Perl may leak user IP addresses. If the communication channel to the statsd daemon is not secured for example, by sending UDP packets to a host on another network, then users' IP addresses may be leaked. Since version 0.9.0, the IP address is no...
CVE-2026-45180 Catalyst::Plugin::Statsd versions through 0.10.0 for Perl may leak session ids
Catalyst::Plugin::Statsd versions through 0.10.0 for Perl may leak session ids. If the communication channel to the statsd daemon is not secured for example, by sending UDP packets to a host on another network, then users' session ids may be leaked. This may allow an attacker to use session ids a...
PT-2026-39537
Name of the Vulnerable Software and Affected Versions Catalyst::Plugin::Statsd versions prior to 0.10.0 Description Catalyst::Plugin::Statsd for Perl may leak session ids. This occurs if the communication channel to the statsd daemon is not secured, such as when sending UDP packets to a host on...
centipede
centipede Self-replicating Linux worm framework with multi-la...
MGASA-2026-0124 Updated rootcerts, nss & firefox packages fix security vulnerabilities
Use-after-free in the DOM: Core & HTML component. CVE-2026-6746 Use-after-free in the WebRTC component. CVE-2026-6747 Uninitialized memory in the Audio/Video: Web Codecs component. CVE-2026-6748 Information disclosure due to uninitialized memory in the Graphics: Canvas2D component. CVE-2026-6749...
CVE-2026-43411
A flaw was found in the Linux kernel's TIPC Transparent Inter-Process Communication protocol. A local user can trigger a divide-by-zero error by setting a specific connection timeout value. This can lead to a kernel panic, effectively causing a Denial of Service DoS on the affected system...
MAL-2026-3418 Malicious code in devsite-youtube (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b91bfd75754c68dbb154435c558f33bea4b072f72be4a1d2fe546b5ac062039b The package devsite-youtube was found to contain malicious code. Source: ossf-package-analysis...
Electerm's full process.env exposed to renderer via window.pre.env
Impact The getConstants IPC handler in src/app/lib/ipc-sync.js serialises the entire process.env object and sends it to the renderer. The data is stored as window.pre.env and is accessible from any JavaScript running in the renderer e.g., via the DevTools console or a compromised webview context...
EUVD-2026-28788
Akamai Guardicore Platform Agent GPA and Zero Trust Client on Linux and macOS allow TOCTOU-based local privilege escalation. The GPA service creates an IPC socket in the world-writable /tmp directory. It accepts unauthenticated IPC control messages. This enables a TOCTOU vulnerability in the...
CVE-2026-43291
A flaw was found in the Linux kernel's Near Field Communication NFC NCI subsystem. Incorrect parameter validation for variable-length packet data can lead to communication failures with NCI NFC chips. This issue, stemming from an attempt to prevent access to uninitialized data, results in a Denia...