Linux Distros Unpatched Vulnerability : CVE-2026-31657

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - batman-adv: hold claim backbone gateways by reference batadvblaaddclaim can replace claim-backbonegw and drop the old gateway's last reference while readers sti...

Fedora 44 : rpki-client (2026-879659f6c2)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-879659f6c2 advisory. rpki-client 9.8 - Various refactoring for improved compatibility with various libcrypto implementations and in CA/BGPsec certificate handling. - Fixed an...

Linux Distros Unpatched Vulnerability : CVE-2026-31537

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: server: make use of smbdirectsocket.sendio.bcredits It turns out that our code will corrupt the stream of reassabled data transfer messages when we trigger...

JIZHICMS 注入漏洞

JIZHICMS is an open-source content management system developed by JIZHI Corporation in China. Versions of JIZHICMS 2.5.6 and earlier had a vulnerability related to SQL injection. This vulnerability stemmed from improper handling of parameters in the htmlspecialcharsdecode function located at...

ShowDoc 注入漏洞

ShowDoc is a tool developed by star7th, ideal for online document sharing among IT teams. Versions 2.10.10, 3.6.2, and 3.8.0 of ShowDoc contain injection vulnerabilities. These vulnerabilities stem from improper handling of parameters in the...

Linux Distros Unpatched Vulnerability : CVE-2026-31613

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: fix OOB reads parsing symlink error response When a CREATE returns STATUSSTOPPEDONSYMLINK, smb2checkmessage returns success without any length...

CBL Mariner 2.0 Security Update: CBL-Mariner Releases (CVE-2026-39956)

The version of CBL-Mariner Releases installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2026-39956 advisory. - jq is a command-line JSON processor. In commits after 69785bf77f86e2ea1b4a20ca86775916889e91c9...

Fedora 44 : perl-Net-CIDR-Lite (2026-fe487aa625)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-fe487aa625 advisory. This update addresses two security issues regarding incorrect handling of malformed IPv6 addresses: Fix IPv4 mapped IPv6 packed length CVE-2026-4019...

Linux Distros Unpatched Vulnerability : CVE-2026-31545

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NFC: nxp-nci: allow GPIOs to sleep Allow the firmware and enable GPIOs to sleep. This fixes a WARNON' and allows the driver to operate GPIOs which are connected...

Linux Distros Unpatched Vulnerability : CVE-2026-31684

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: sched: actcsum: validate nested VLAN headers tcfcsumact walks nested VLAN headers directly from skb-data when an skb still carries in-payload VLAN tags. Th...

CLSA-2026-1777026478 Fix CVE(s): CVE-2026-34980

SECURITY UPDATE: control-character injection in scheduler option handling - debian/patches/CVE-2026-34980.patch: filter control characters from IPP string option values and reject "special" PPD keywords cupsFilter, cupsFilter2, etc. reported back by job filters to prevent filter/command injection...

CVE-2026-31647

A flaw was found in the Linux kernel's idpf driver. This vulnerability arises from improper nesting of spinlocks during asynchronous Virtual Channel VC handling. An attacker could potentially trigger an invalid wait context, leading to a system crash or denial of service. Mitigation To reduce...

Prototype Pollution

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution via the mergeDirectKeys function in mergeConfig. An attacker can force a request configuration to inherit attacker-controlled properti...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +16000 more potentially affected by CVE-2026-42038 via axios (>=1.0.0, <=1.15.0)

axios NPM version =1.0.0, =0.0.8, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-42038 Source advisory: SNYK:JS-AXIOS-16298095...

CVE-2026-42041

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution to silently suppress all HTTP error responses 401, 403, 500, etc., causing them to be...

EUVD-2026-25582

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78, Deriver::derive and PkeyCtxRef::derive sets len = buf.len and passes it as the in/out length to EVPPKEYderive, relying on OpenSSL to honor it. On OpenSSL 1.1.x, X25519, X448, DH and HKDF-extra...

CVE-2026-31552

A flaw was found in the Linux kernel's wlcore component. When the system attempts to allocate memory for a network packet and there is insufficient space, an incorrect error code is returned. This error handling issue causes the system to repeatedly attempt to process the same packet in an endles...

CVE-2026-31544

A flaw was found in the Linux kernel's armscmi firmware component. The scmieventhandlergetops helper function can return a NULL pointer when an event handler is not found or created, instead of an expected error pointer. This improper handling of the error path leads to a NULL dereference...

CVE-2026-31539

A flaw was found in the Linux kernel's smbdirect module. A race condition in the receive credit management logic allows the system to grant credits that a peer has already consumed. This timing vulnerability, occurring during the processing of incoming data, could lead to resource exhaustion and...

CVE-2026-31666

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix incorrect return value after changing leaf in lookupextentdataref After commit 1618aa3c2e01 "btrfs: simplify return variables in lookupextentdataref", the err and ret variables were merged into a single ret variable...