18403 matches found
ROS-20260629-73-0025
The vulnerability in assimp is related to overflow of buffers in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
ROS-20260629-73-0021
The vulnerability in Angie is related to the overflow of buffers in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
ROS-20260629-73-0014
The vulnerability in gpac is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
The vulnerability of the JetBrains Hub software management system lies in the insufficient control over the modification of dynamically defined object characteristics. This allows attackers to circumvent security restrictions, gain unauthorized access to protected information, and enhance their privileges.
The vulnerability of the JetBrains Hub account management software is related to insufficient control over the modification of dynamically defined object properties. Exploiting this vulnerability can allow a malicious actor to bypass security restrictions, gain unauthorized access to protected...
BusyBox: BusyBox: Arbitrary Code Execution via DHCPv6 Client Heap Buffer Overflow
A flaw was found in BusyBox. A heap buffer overflow vulnerability exists in the Dynamic Host Configuration Protocol version 6 DHCPv6 client, specifically within the optiontoenv function. Network-adjacent attackers can exploit this by sending a crafted DHCPv6 response containing a malformed...
Linux Distros Unpatched Vulnerability : CVE-2026-40011
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalid output to be...
MAL-2026-6544 Malicious code in chai-as-persisted (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5cf9c49450e0fa0d47be1b6ae27991f844868ff6c435d2082948b5feae862709 The package's postinstall script npm run smoke:pino executes index.js, which spawns a detached node lib/initializeCaller.js child. That module hides...
[SECURITY] Fedora 43 Update: lighttpd-1.4.84-1.fc43
lighttpd pronounced /lighty/ is a secure, fast, compliant, and very flexible web server that has been optimized for high-performance environments. lighttpd uses memory and CPU efficiently and has lower resource use than other popular web servers. Its advanced feature-set FastCGI, CGI, Auth,...
GHSA-WW5P-J6CJ-6MQQ Nezha Dashboard: DDNS and Notification credential exposure via unredacted list API
Summary The GET /api/v1/ddns and GET /api/v1/notification endpoints return full resource objects including plaintext third-party API credentials — Cloudflare API tokens, TencentCloud SecretKeys, Slack/Discord/Telegram webhook URLs with embedded bot tokens, and Authorization header values — withou...
Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context
Summary PATCH /server/id accepts and persists nonexistent ddnsprofiles IDs for a member-owned server. If another user later creates a DDNS profile with one of those IDs, the DDNS worker resolves the stored ID and dispatches an update using the other user's DDNS profile configuration in the contex...
GHSA-39G2-8X68-PMX8 Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context
Summary PATCH /server/id accepts and persists nonexistent ddnsprofiles IDs for a member-owned server. If another user later creates a DDNS profile with one of those IDs, the DDNS worker resolves the stored ID and dispatches an update using the other user's DDNS profile configuration in the contex...
CVE-2026-38641
An issue in the DSO::mmapandcopy function of relibc commit 61f42d allows attackers to cause a Denial of Service DoS via loading a crafted shared library...
CVE-2026-47205
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.36.0 until 1.36.9, 1.37.5, and 1.38.3, a Use-After-Free UAF vulnerability leading to a sudden segmentation fault exists in Envoy's extauthz HTTP filter when processing per-route authorization overrides...
Improper Control of Dynamically-Identified Variables
Overview Affected versions of this package are vulnerable to Improper Control of Dynamically-Identified Variables via the handling of environment variables in container images. An attacker can access sensitive host environment variables by crafting a container image with an environment variable...
Malicious code in react-dynammic-table-component (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d47aff9bb18dcd61350fa86e19d97ddee5ee7c5bdf7f0adea4a685e89d58fa4f [email protected] declares a preinstall lifecycle script node dist/setup.js that runs automatically on npm install. The script...
Guardian Agents: The Next Layer of Identity Governance
AI agents are moving through enterprise environments, inheriting permissions, traversing systems, and executing decisions at machine speed with minimal oversight. The identity infrastructure built to govern human access wasn't designed for autonomous actors, and the gap between what enterprises a...
SUSE CVE-2026-40011
An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalid output to be produced in the prometheus endpoint. The prometheus endpoint will then be rejected by the scraper until the dynamic block expires...
ROS-20260626-73-0032
The vulnerability in ImageMagick is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
