Uncontrolled resource consumption and loop with unreachable exit condition in facil.io and downstream iodine ruby gem

Summary fiojsonparse can enter an infinite loop when it encounters a nested JSON value starting with i or I. The process spins in user space and pegs one CPU core at 100% instead of returning a parse error. Because iodine vendors the same parser code, the issue also affects iodine when it parses...

GHSA-2X79-GWQ3-VXXM Uncontrolled resource consumption and loop with unreachable exit condition in facil.io and downstream iodine ruby gem

Summary fiojsonparse can enter an infinite loop when it encounters a nested JSON value starting with i or I. The process spins in user space and pegs one CPU core at 100% instead of returning a parse error. Because iodine vendors the same parser code, the issue also affects iodine when it parses...

core2 is unmaintained, all versions yanked

The maintainer decided stop maintaining crate and yanked all published versions. Potential alternatives: - embedded-io solves the same general problem - no-std-io2 is a maintained fork...

RUSTSEC-2026-0105 core2 is unmaintained, all versions yanked

The maintainer decided stop maintaining crate and yanked all published versions. Potential alternatives: - embedded-io solves the same general problem - no-std-io2 is a maintained fork...

Uncontrolled resource consumption and loop with unreachable exit condition in facil.io and downstream iodine ruby gem

Summary fiojsonparse can enter an infinite loop when it encounters a nested JSON value starting with i or I. The process spins in user space and pegs one CPU core at 100 instead of returning a parse error. Because iodine gem vendors the same parser code, the issue also affects iodine gem when it...

Fedora 44 : ImageMagick / LibRaw / OpenImageIO / OpenImageIO2.5 / etc (2026-bef0050737)

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-bef0050737 advisory. LibRaw 0.22.1 and rebuilds ---- Release 3.1.12.0 Apr 1, 2026 -- compared to 3.1.11.0 oiiotool: Better type understanding with -i:ch= and other clean...

PT-2026-51726

Name of the Vulnerable Software and Affected Versions Linux kernel versions from November 2022 through April 2026 Description An issue exists in the io poll get ownership function within the io uring/poll component. The function uses a signed comparison to determine if poll refs has reached the...

CVE-2026-35490

changedetection.io is a free open source web page change detection tool. Prior to 0.54.8, the @loginoptionallyrequired decorator is placed before outer to @blueprint.route instead of after it. In Flask, @route must be the outermost decorator because it registers the function it receives. When the...

The vulnerability of the btrfs_validate_super() function in the fs/btrfs/disk-io.c file of the Linux kernel’s file system allows a hacker to trigger a service failure.

The vulnerability of the btrfsvalidatesuper function in the fs/btrfs/disk-io.c file of the btrfs file system in Linux kernel is related to incorrect handling of error situations. Exploiting this vulnerability can allow an attacker to cause a service failure...

CLSA-2026-1775655705 kernel-uek: Fix of 34 CVEs

ALSA: usb-audio: Fix use-after-free in sndusbmixerfree CVE-2026-23089 - HID: core: Harden s32ton against conversion to 0 bits CVE-2025-38556 - KVM: nSVM: Ignore nCR34:0 when loading PDPTEs from memory CVE-2024-50115 - KVM: x86: Reset IRTE to host control if new route isn't postable CVE-2025-37885...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-006769)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006769 advisory. In the Linux kernel, the following vulnerability has been resolved: pcmcia: Fix a NULL pointer dereference in iodynfindioregion In iodynfindioregion,...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-006610)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006610 advisory. In the Linux kernel, the following vulnerability has been resolved: dm integrity: call kmemcachedestroy in dmintegrityinit error path Otherwise the journaliocache wi...

PYSEC-2026-28

changedetection.io is a free open source web page change detection tool. Prior to 0.54.8, the @loginoptionallyrequired decorator is placed before outer to @blueprint.route instead of after it. In Flask, @route must be the outermost decorator because it registers the function it receives. When the...

CVE-2026-35490 changedetection.io has an Authentication Bypass via Decorator Ordering

changedetection.io is a free open source web page change detection tool. Prior to 0.54.8, the @loginoptionallyrequired decorator is placed before outer to @blueprint.route instead of after it. In Flask, @route must be the outermost decorator because it registers the function it receives. When the...

CVE-2026-35490 changedetection.io has an Authentication Bypass via Decorator Ordering

changedetection.io is a free open source web page change detection tool. Prior to 0.54.8, the @loginoptionallyrequired decorator is placed before outer to @blueprint.route instead of after it. In Flask, @route must be the outermost decorator because it registers the function it receives. When the...

CVE-2025-52908

An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1280, 1330, 1380, 1480, 1580, W920, W930, and W1000. Incorrect Handling of the NL80211 vendor command leads to a buffer overflow via a certain ioctl message, issue 1 of 2...

changedetection.io 安全漏洞

changedetection.io is a website change detection, monitoring, and notification application developed by dgtlmoon. Versions of changedetection.io prior to 0.54.8 contained a security vulnerability. This vulnerability occurred because the @loginoptionallyrequired decorator was placed before...

CVE-2026-5602

A vulnerability was determined in Nor2-io heim-mcp up to 0.1.3. Impacted is the function registerTools of the file src/tools.ts of the component newheimapplication/deployheimapplication/deployheimapplicationtocloud. This manipulation causes os command injection. The attack requires local access...

CVE-2026-34755

A flaw was found in vLLM, an inference and serving engine for large language models. A remote attacker can exploit a vulnerability in the VideoMediaIO.loadbase64 method by sending a single API request containing a large number of comma-separated base64-encoded JPEG frames. This bypasses the...

Incorrect Authorization

Overview changedetection.io is a Website change detection and monitoring service Affected versions of this package are vulnerable to Incorrect Authorization due to improper decorator ordering in route registration. An attacker can gain unauthorized access to sensitive backup files, exfiltrate...