Azure Linux 3.0 Security Update: kernel (CVE-2024-47730)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-47730 advisory. - In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/qm - inject error befo...

Allocation of Resources Without Limits or Throttling

Overview org.webjars.npm:seroval is a Stringify JS values Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the encoded array lengths serialization process. An attacker can cause excessive processing time by overriding encoded array lengt...

Improper Verification of Cryptographic Signature

Overview org.webjars.npm:sm-crypto is a sm-crypto Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the SM2 signature verification process. An attacker can bypass signature validation by forging signatures for arbitrary public keys. Remediatio...

Insufficient Verification of Data Authenticity

Overview org.webjars.npm:sm-crypto is a sm-crypto Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the SM2 decryption logic. An attacker can recover sensitive private key material by repeatedly interacting with the decryption interface...

LastPass Warns of Fake Maintenance Messages Targeting Users' Master Passwords

LastPass is alerting users to a new active phishing campaign that's impersonating the password management service, which aims to trick users into giving up their master passwords. The campaign, which began on or around January 19, 2026, involves sending phishing emails claiming upcoming maintenan...

CRLF Injection

Overview Affected versions of this package are vulnerable to CRLF Injection via the http.cookies.Morsel field. An attacker can manipulate HTTP responses by injecting arbitrary headers through user-controlled cookie values or parameters. Remediation A fix was pushed into the master branch but not...

HTTP Response Splitting

Overview Affected versions of this package are vulnerable to HTTP Response Splitting via the wsgiref.headers.Headers. An attacker can manipulate HTTP responses by injecting arbitrary headers through user-controlled input containing newline characters. Remediation A fix was pushed into the master...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the totalPCMFrameCount field from FLAC metadata before buffer size calculation. An attacker can cause a program crash or resource exhaustion by providing a specially crafted file. Remediation A fix was...

Release of Invalid Pointer or Reference

Overview Affected versions of this package are vulnerable to Release of Invalid Pointer or Reference via the BilateralBlurImage function. An attacker can cause application instability or crashes by providing a specially crafted image that triggers the release of an invalid pointer when memory...

MiracleLinux 8 : cloud-init-19.4-1.el8.7 (AXSA:2020-635:05)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2020-635:05 advisory. cloud-init: default configuration disabled deletion of SSH host keys CVE-2018-10896 The default cloud-init configuration, in cloud-init 0.6.2 and newer,...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the LoadFontData function. An attacker can cause memory corruption or unexpected behavior by providing crafted input that triggers an integer overflow during font data processing. This is only...

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the GenImageFontAtlas function. An attacker can execute arbitrary code or cause a denial of service by providing specially crafted input that triggers a heap-based buffer overflow during local execution...

WordPress Quote Master plugin <= 7.1.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by 0xVenus in WordPress Plugin Quote Master versions = 7.1.1...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the validate input size of hashtags in HTTP requests. An attacker can exhaust CPU resources by submitting a single HTTP request containing a post with thousands of space-separated...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the validate input size of hashtags in HTTP requests. An attacker can exhaust CPU resources by submitting a single HTTP request containing a post with thousands of space-separated...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001636)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001636 advisory. It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster...

Dive code injection vulnerability

Dive is a desktop application for MCP hosts, open-sourced by OpenAgentPlatform. Versions of Dive prior to 0.13.0 contained a code injection vulnerability. This vulnerability stemmed from specially crafted deep links that allowed the installation of MCP server configurations controlled by attacker...

MiracleLinux 7 : firefox-60.2.1-1.0.1.el7.AXS7 (AXSA:2018-3344:06)

The remote MiracleLinux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2018-3344:06 advisory. Mozilla: Crash in TransportSecurityInfo due to cached data CVE-2018-12385 Mozilla: Setting a master password post-Firefox 58 does not delete...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001121)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001121 advisory. A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network who is able to alte...

CVE-2025-68783

An out-of-bounds write flaw was found in the Linux kernel's ALSA USB mixer driver for Tascam US-16x08 audio interfaces. The getmeterlevelsfromurb function extracts channel indices from USB packets without validating the range. A malicious or malfunctioning USB device can send packets with...