100233 matches found
Security update for perl-DBI
This update for perl-DBI fixes the following issues CVE-2026-14380: unvalidated string eval interpolation of the Profile package name can lead to arbitrary Perl code execution bsc1271018. CVE-2026-14740: one-byte out-of-bounds read when deleting an initial SQL comment line can lead to a process...
MZ Automation lib60870
ADVISORY SUMMARY Successful exploitation of these vulnerabilities could crash the device being accessed. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices...
gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb
A heap buffer overflow vulnerability was found in GStreamer's librfb RFB/VNC client. The rectangle bounds check incorrectly validates area rather than individual dimensions, allowing a malicious VNC server to send a rectangle that extends beyond the framebuffer. A remote attacker could set up a...
CVE-2026-64455
A flaw was found in the Linux kernel's chaoskey driver. A local user could trigger a use-after-free vulnerability by closing the device file after the associated USB device has been unplugged. This could lead to a system crash due to memory corruption when a debugging statement attempts to access...
CVE-2026-64488
A flaw was found in the Linux kernel's Advanced Linux Sound Architecture ALSA 'aoa' component. This vulnerability arises when a specific function, sndctlnew1, fails to allocate memory and returns an invalid pointer. The kernel then attempts to use this invalid pointer, which can cause the system ...
nodejs: Node.js: Denial of Service via DNS responses with excessive A records
A denial of service DoS vulnerability in Node.js allows a remote attacker to crash the application. By sending a specially crafted DNS response with an excessive number of 'A' records, an attacker can cause the dns.resolveAny function to unexpectedly abort the process...
nodejs: Node.js: Denial of Service vulnerability
A flaw was found in Node.js. A malicious actor could exploit this vulnerability by providing a specially crafted input to the synchronous node:zlib APIs. This could cause the Node.js process to crash, leading to a denial of service and making the application unavailable to users...
CVE-2026-64489
A flaw was found in the ALSA Advanced Linux Sound Architecture ymfpci driver in the Linux kernel. This vulnerability occurs because the 'sndctlnew1' function, which allocates memory, may return a null value if memory allocation fails. The driver then attempts to use this null value without proper...
CVE-2026-59952 Valibot: record() issue paths can make flatten() throw for inherited Object property names
Valibot helps validate data using a schema. Versions prior to 1.4.2 can throw a TypeError inside its flatten helper when validation issues contain attacker-controlled object keys such as toString, valueOf, or hasOwnProperty. The issue is reachable through normal record validation. record...
Apache Traffic Server buffer overflow vulnerability (CNVD-2026-30698)
Apache Traffic Server is a high-performance HTTP proxy server open source from the Apache Foundation in the United States. Apache Traffic Server has a buffer overflow vulnerability, which stems from improper handling of input by the urisigning and urlsig plugins. Attackers can exploit this...
PT-2026-66521
Name of the Vulnerable Software and Affected Versions OpenVPN versions 2.7 alpha1 through 2.7.4 Description The Windows interactive service contains a flaw that allows remote attackers to trigger a service crash or persistent DNS state pollution. This occurs when a crafted search domain is...
Apache Traffic Server deserialization injection vulnerability
Apache Traffic Server is a high-performance HTTP proxy server open source from the Apache Foundation in the United States. Apache Traffic Server has a deserialization injection vulnerability, which stems from improper handling of disk cache fields and object lifecycle management. Attackers can...
PT-2026-66463
Name of the Vulnerable Software and Affected Versions PHP versions 8.2.0 through 8.2.32 PHP versions 8.3.0 through 8.3.32 PHP versions 8.4.0 through 8.4.23 PHP versions 8.5.0 through 8.5.8 Description Circular symbolic links in phar archives can cause unbounded recursion, which exhausts the C sta...
PT-2026-66596
Name of the Vulnerable Software and Affected Versions Capsule versions prior to 0.13.8 Description The configuration admission webhook fails to validate the CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec.NodeMetadata.ForbiddenAnnotations.Regex variables...
Apache Traffic Server input validation error vulnerability (CNVD-2026-30696)
Apache Traffic Server is a high-performance HTTP proxy server open source from the Apache Foundation in the United States. There is an input crash vulnerability in Apache Traffic Server. The reason for this vulnerability is that it fails to properly handle inputs affected by attackers. Attackers...
PT-2026-66604
Name of the Vulnerable Software and Affected Versions re2 versions prior to 1.25.2 Description The software validates lastIndex against the UTF-8 byte length of a subject but incorrectly uses it as a UTF-16 code-unit offset in the exec, test, match, replace, and split functions. When a non-ASCII...
Fedora 44 : pack (2026-8729dce4b8)
The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-8729dce4b8 advisory. Security update to pack 0.40.8 Fixes CVE-2024-25621: containerd - local privilege escalation Fixes CVE-2025-47913: golang.org/x/crypto/ssh/agent - S...
nodejs: Node.js: Denial of Service via DNS responses with excessive A records
A denial of service DoS vulnerability in Node.js allows a remote attacker to crash the application. By sending a specially crafted DNS response with an excessive number of 'A' records, an attacker can cause the dns.resolveAny function to unexpectedly abort the process...
nodejs: Node.js: Denial of Service vulnerability
A flaw was found in Node.js. A malicious actor could exploit this vulnerability by providing a specially crafted input to the synchronous node:zlib APIs. This could cause the Node.js process to crash, leading to a denial of service and making the application unavailable to users...