CVE-2024-42002 Unsafe use of eval() method in ros2 topic hz tool

A code injection vulnerability has been discovered in the Robot Operating System 2 ROS 2 'ros2topic' command-line tool, affecting all ROS 2 distributions from Crystal Clemmys up to and including Lyrical Luth and Rolling Ridley. The vulnerability lies in the 'hz' verb, which reports the publishing...

CVE-2024-42002

A code injection vulnerability exists in the ROS 2 'ros2topic' command-line tool, specifically within the 'hz' verb . The flaw occurs because the tool accepts a user-provided Python expression via the --filter option and passes it directly to the eval() function without any sanitization. This all...

PT-2026-102382

A code injection vulnerability has been discovered in the Robot Operating System 2 ROS 2 'ros2topic' command-line tool, affecting all ROS 2 distributions from Crystal Clemmys up to and including Lyrical Luth and Rolling Ridley. The vulnerability lies in the 'hz' verb, which reports the publishing...

CVE-2024-42002: Improper Neutralization of Directives in Dynamically Evaluated Code

A code injection vulnerability has been discovered in the Robot Operating System 2 ROS 2 'ros2topic' command-line tool, affecting all ROS 2 distributions from Crystal Clemmys up to and including Lyrical Luth and Rolling Ridley. The vulnerability lies in the 'hz' verb, which reports the publishing...

EUVD-2026-62348

Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly check the size of the caller-supplied output buffer before writing converted characters. An application that uses iconv3 to convert untrusted input to or from one of the affected encodings may be vulnerable to buffer...

CVE-2026-58081

Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly check the size of the caller-supplied output buffer before writing converted characters. An application that uses iconv3 to convert untrusted input to or from one of the affected encodings may be vulnerable to buffer...

CVE-2026-58081

A heap-based buffer overflow exists in the iconv(3) library because several encoding modules, specifically HZ, UTF-7, VIQR, and ZW , fail to validate the size of caller-supplied output buffers before writing converted characters. Applications processing untrusted input through these encodings are...

CVE-2026-58081: Heap-based Buffer Overflow

Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly check the size of the caller-supplied output buffer before writing converted characters. An application that uses iconv3 to convert untrusted input to or from one of the affected encodings may be vulnerable to buffer...

aloni (>=0.2.1, <=0.2.3), code-exec-hz (>=1.0.0, <=1.0.1) +6 more potentially affected by CVE-2026-42544 via granian (>=1.3.2, <=2.6.1)

granian PYPI version =1.3.2, =0.2.1, =1.0.0, =2.5.10, =1.0.0, =0.2.0, =0.0.1, =2025.1.0b1, =0.1.1, =0.3.1 Source cves: CVE-2026-42544 Source advisory: OSV:PYSEC-2026-2503...

FreeBSD : FreeBSD -- Multiple vulnerabilities in iconv(3) (78910e7e-74e3-11f1-958d-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 78910e7e-74e3-11f1-958d-bc241121aa0a advisory. Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly check the size o...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: spi: hisi-kunpeng: Added verification for the maxfrequency value provided by the firmware. If the value of maxspeedhz is 0, it may cause a division by zero error in hisicalceffectivespeed. The value of maxspeedhz is provided by t...

aloni (>=0.2.1, <=0.2.3), another (0.1.0) +7 more potentially affected by CVE-2026-42545 via granian (>=0.2.6, <=2.6.1)

granian PYPI version =0.2.6, =0.2.1, =1.0.0, =2.5.0, =1.0.0, =0.2.0, =0.0.1, =2025.1.0b1, =0.1.1, =0.3.1 Source cves: CVE-2026-42545 Source advisory: OSV:GHSA-F5P7-9FR5-8JMJ...

aloni (>=0.2.1, <=0.2.3), another (0.1.0) +7 more potentially affected by CVE-2026-42545 via granian (>=0.2.6, <=2.6.1)

granian PYPI version =0.2.6, =0.2.1, =1.0.0, =2.5.0, =1.0.0, =0.2.0, =0.0.1, =2025.1.0b1, =0.1.1, =0.3.1 Source cves: CVE-2026-42545 Source advisory: GHSA-F5P7-9FR5-8JMJ...

CVE-2026-31603 staging: sm750fb: fix division by zero in ps_to_hz()

In the Linux kernel, the following vulnerability has been resolved: staging: sm750fb: fix division by zero in pstohz pstohz is called from hwsm750crtcsetmode without validating that pixclock is non-zero. A zero pixclock passed via FBIOPUTVSCREENINFO causes a division by zero. Fix by rejecting zer...

EUVD-2012-4151

Malware in sbrugna...

CVE-2025-11326

CVE-2025-11326 affects Tenda AC18 (version 15.03.05.19(6318)). The vulnerability resides in the wifi_chkHz handling of the /goform/WifiMacFilterSet file, where input length validation can cause a stack-based buffer overflow. This can be exploited remotely, and multiple sources note that an exploi...

UBUNTU-CVE-2024-41148

A code injection vulnerability has been discovered in the Robot Operating System ROS 'rostopic' command-line tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability lies in the 'hz' verb, which reports the publishing rate of a topic and accepts a user-provided Python...

CVE-2024-41148 Unsafe use of eval() method in rostopic hz tool

A code injection vulnerability has been discovered in the Robot Operating System ROS 'rostopic' command-line tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability lies in the 'hz' verb, which reports the publishing rate of a topic and accepts a user-provided Python...

CVE-2024-41148: Improper Neutralization of Directives in Dynamically Evaluated Code

A code injection vulnerability has been discovered in the Robot Operating System ROS 'rostopic' command-line tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability lies in the 'hz' verb, which reports the publishing rate of a topic and accepts a user-provided Python...

UBUNTU-CVE-2025-38193

In the Linux kernel, the following vulnerability has been resolved: netsched: schsfq: reject invalid perturb period Gerrard Tai reported that SFQ perturbperiod has no range check yet, and this can be used to trigger a race condition fixed in a separate patch. We want to make sure ctl-perturbperio...