CVE-2020-37286 Vyper 0.1.0b4 before 0.3.0 Memory Corruption via Nested Internal Function Calls

Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear inside tuples or nested calls. Contracts using such calls as tuple elements, call arguments, or builtin arguments like concat or ecrecover can...

CLSA-2026-1792163363 TuxCare security update for concat-stream (1 CVE)

TuxCare rebuilt concat-stream to address 1 CVE. Fixed in 1.5.1-tuxcare.1...

PT-2026-124642

TuxCare rebuilt concat-stream to address 1 CVE. Fixed in 1.5.1-tuxcare.1...

CVE-2026-110645

Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines. Attackers who influence file names passed to concat, cut, or merge can inject shell...

CVE-2026-110645 Video-stitch before 2.0.0-beta.1 OS Command Injection via concat() and cut()

Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines. Attackers who influence file names passed to concat, cut, or merge can inject shell...

CVE-2026-110645

The Video-stitch software (versions before 2.0.0-beta.1 ) is vulnerable to an OS command injection vulnerability. The root cause is the improper neutralization of shell metacharacters when file names are interpolated unquoted into shell-executed ffmpeg command lines. Attackers who can influence f...

EUVD-2026-101273

Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines. Attackers who influence file names passed to concat, cut, or merge can inject shell...

CVE-2026-110645

Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines. Attackers who influence file names passed to concat, cut, or merge can inject shell...

CVE-2026-110645 Video-stitch before 2.0.0-beta.1 OS Command Injection via concat() and cut()

Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines. Attackers who influence file names passed to concat, cut, or merge can inject shell...

PT-2026-114087

Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines. Attackers who influence file names passed to concat, cut, or merge can inject shell...

CVE-2026-110645: Improper Neutralization of Special Elements used in an OS Command

Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines. Attackers who influence file names passed to concat, cut, or merge can inject shell...

EulerOS 2.0 SP13 : sqlite (EulerOS-SA-2026-4200)

According to the versions of the sqlite packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain sensitive information via the Session Extension changeset...

PT-2026-94498

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Device leaks occur during parse failures within the pnfs/blocklayout component. The functions bl parse concat and bl parse stripe allocate a child device array and parse each child...

CVE-2026-48490

ArduinoCore-avr (the source code and configuration files of the Arduino AVR Boards platform) contains a stack-based buffer overflow in its floating-point concatenation path. Versions prior to 1.8.8 are affected. Passing values near the extremes of the float or double range to String::concat(float...

CVE-2026-48490: Buffer Copy without Checking Size of Input

ArduinoCore-avr contains the source code and configuration files of the Arduino AVR Boards platform. A vulnerability in versions prior to 1.8.8 allows an attacker to trigger a stack-based buffer overflow when concatenating floating-point values of sufficiently large magnitude onto an Arduino Stri...

GHSA-2X7J-588G-CCC2 Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list

Summary Nodemailer's address parser lib/addressparser/index.js parses a list of comma‑separated addresses in quadratic time — On² in the number of addresses. A single crafted address string e.g. a To, Cc, Bcc, From, or Reply‑To value, or any value passed to the exported addressparser therefore...

LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process

Summary The join filter src/filters/array.ts:8-13 charges memoryLimit by array element count, not by the string length it produces, letting a template bypass a configured memoryLimit and allocate strings far past budget — bounded only by V8/process limits, not by memoryLimit. Details js //...

EUVD-2026-63090

LiquidJS: Uncontrolled Resource Consumption in join filter allows template authors to bypass memoryLimit and crash the process...

SUSE CVE-2026-68468

In the Linux kernel, the following vulnerability has been resolved: mtd: virt-concat: free duplicate generated name Every MTD registration runs mtdvirtconcatcreatejoin. Once a virtual concat has already been registered, the function builds the same name again and takes the equal-name branch. That...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: mtd:virt-concat: free duplicate generated name Every MTD registration runs mtdvirtconcatcreatejoin. Once a virtual concat has been registered, the function generates the same name again and proceeds to the equal-name branch. This...