CVE-2026-29062

jackson-core contains core low-level incremental "streaming" parser and generator abstractions used by Jackson Data Processor. From version 3.0.0 to before version 3.1.0, the UTF8DataInputJsonParser, which is used when parsing from a java.io.DataInput source, bypasses the maxNestingDepth constrai...

GHSA-V66J-6WWF-JC57 Mercurius: Incorrect Content-Type parsing can lead to CSRF attack

Summary A Cross-Site Request Forgery CSRF vulnerability was identified in Mercurius versions 16. The issue arises from incorrect parsing of the Content-Type header in requests. Specifically, requests with Content-Type values such as application/x-www-form-urlencoded, multipart/form-data, or...

CVE-2025-50189 Chamilo: Error-based SQL Injection

Chamilo is a learning management system. Prior to version 1.11.30, the application performs insufficient validation of data coming from the user from the POST resourcedocumentSQLINJECTIONHERE and POST login parameters found in /main/coursecopy/copycoursesessionselected.php, which allows an attack...

PT-2025-55012

Уязвимость программного обеспечения для пересылки журналов логов Elastick Stack Filebeat связана с некорректным вводом конфигурационных данных. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании...

Unity Linux 20.1060a / 20.1070a Security Update: abrt (UTSA-2025-991235)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-991235 advisory. A flaw was found in the ABRT daemons handling of user-supplied mount information.ABRT copies up to 12 characters from an untrusted input and places them directly int...

CISA Software Acquisition Guide Supplier Response Web Tool XSS

RISK EVALUATION The CISA Software Acquisition Guide Supplier Response Web Tool before 2025-12-11 was vulnerable to cross-site scripting via text fields. If an attacker could convince a user to import a specially-crafted JSON file, the Tool would load JavaScript from the file into the page. The...

net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY

...

CVE-2025-40120

In the Linux kernel, the following vulnerability has been resolved: net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock Prevent USB runtime PM autosuspend for AX88772 in bind. usbnet enables runtime PM autosuspend by default, so disabling it via the usbdriver flag is ineffective. O...

EUVD-2021-11633

Malware in sbrugna...

EUVD-2018-3651

Malware in sbrugna...

The vulnerability of the Linux operating system’s kernel, related to incorrect checking of data size at the input stage, allows a hacker to trigger a service failure.

The vulnerability of the Linux operating system’s kernel is related to incorrect checking of the amount of data at the input stage. Exploiting this vulnerability allows an attacker to cause a service failure...

PT-2025-46595

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel related to USB runtime power management PM and Real-Time Network Layer RTNL interactions with the AX88772 network adapter. The issue arises when runtime...

EUVD-2024-30797

Malicious code in bioql PyPI...

EUVD-2024-48819

Malicious code in bioql PyPI...

EUVD-2025-26417

Malicious code in bioql PyPI...

EUVD-2023-44402

Malicious code in bioql PyPI...

CVE-2025-8696

If an unauthenticated user sends a large amount of data to the Stork UI, it may cause memory and disk use problems for the system running the Stork server. This issue affects Stork versions 1.0.0 through 2.3.0...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that originates from an improper PHY address mask during initialization of the MDIO bus in net/usb/asixdevices...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the dataAddonlayouts and dataAddonlayoutsexcept parameters in the /apprain/developer/addons/update/dialogs process. An attacker can execute arbitrary scripts in the context of a user's browser by submitting...

Linux Distros Unpatched Vulnerability : CVE-2025-22241

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - File contents overwrite the VirtKey class is called when on-demand pillar data is requested and uses un- validated input to create paths to the pki directory. T...