netbsd_hfs

NetBSD hfs local overflow Bug details: sizet hfslibreadanodeoffsetsvoid inbytes, uint16t outoffsetarray void ptr; if inbytes == NULL || outoffsetarray == NULL return 0; ptr = inbytes; / The offset for record 0 which is the very last offset in the node is always equal to 14, the size of the node...

GHSA-7648-JMWF-VW7J systeminformation has prototype pollution in `networkStats()` via the interface name

Summary networkStats keeps a per interface cache for computing rxsec / txsec between calls. The cache is a plain JavaScript object and is indexed with the interface name the caller supplied. Passing the name proto makes every cache write land on Object.prototype instead of the cache, polluting...

EUVD-2026-111104

systeminformation has prototype pollution in networkStats via the interface name...

systeminformation has prototype pollution in `networkStats()` via the interface name

Summary networkStats keeps a per interface cache for computing rxsec / txsec between calls. The cache is a plain JavaScript object and is indexed with the interface name the caller supplied. Passing the name proto makes every cache write land on Object.prototype instead of the cache, polluting...

CVE-2026-116674

systeminformation is a System and OS information library for node.js. Prior to 5.33.13, networkStatsifaces in lib/network.js on FreeBSD, OpenBSD, and NetBSD stores per-interface data in the plain-object network cache and indexes it with the sanitized caller-controlled interface name. Passing prot...

Linux Distros Unpatched Vulnerability : CVE-2026-116674

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - systeminformation is a System and OS information library for node.js. Prior to 5.33.13, networkStatsifaces in lib/network.js on FreeBSD, OpenBSD, and NetBSD...

DEBIAN-CVE-2026-116674

systeminformation is a System and OS information library for node.js. Prior to 5.33.13, networkStatsifaces in lib/network.js on FreeBSD, OpenBSD, and NetBSD stores per-interface data in the plain-object network cache and indexes it with the sanitized caller-controlled interface name. Passing prot...

CVE-2026-116674

systeminformation is a System and OS information library for node.js. Prior to 5.33.13, networkStatsifaces in lib/network.js on FreeBSD, OpenBSD, and NetBSD stores per-interface data in the plain-object network cache and indexes it with the sanitized caller-controlled interface name. Passing prot...

CVE-2026-116674

systeminformation is a System and OS information library for node.js. Prior to 5.33.13, networkStatsifaces in lib/network.js on FreeBSD, OpenBSD, and NetBSD stores per-interface data in the plain-object network cache and indexes it with the sanitized caller-controlled interface name. Passing prot...

UBUNTU-CVE-2026-116674

systeminformation is a System and OS information library for node.js. Prior to 5.33.13, networkStatsifaces in lib/network.js on FreeBSD, OpenBSD, and NetBSD stores per-interface data in the plain-object network cache and indexes it with the sanitized caller-controlled interface name. Passing prot...

CVE-2026-116674

systeminformation is a System and OS information library for node.js. Prior to 5.33.13, networkStatsifaces in lib/network.js on FreeBSD, OpenBSD, and NetBSD stores per-interface data in the plain-object network cache and indexes it with the sanitized caller-controlled interface name. Passing prot...

CVE-2026-116674

The systeminformation library for Node.js is vulnerable to Prototype Pollution in the networkStats(ifaces) function within lib/network.js on FreeBSD , OpenBSD , and NetBSD systems. Prior to version 5.33.13 , the library stores per-interface data in a plain-object cache and indexes it using a call...

CVE-2026-116674 systeminformation: Prototype pollution in `networkStats()` via the interface name

systeminformation is a System and OS information library for node.js. Prior to 5.33.13, networkStatsifaces in lib/network.js on FreeBSD, OpenBSD, and NetBSD stores per-interface data in the plain-object network cache and indexes it with the sanitized caller-controlled interface name. Passing prot...

CVE-2026-116674 systeminformation: Prototype pollution in `networkStats()` via the interface name

systeminformation is a System and OS information library for node.js. Prior to 5.33.13, networkStatsifaces in lib/network.js on FreeBSD, OpenBSD, and NetBSD stores per-interface data in the plain-object network cache and indexes it with the sanitized caller-controlled interface name. Passing prot...

naxsi

Project Status This is a project status update regarding Naxsi. As you may have noticed, the development of Naxsi has been stopped and the repository will be archived for historical reasons. This means that no new updates or bug fixes will be released for this version. However, if you wish to...

PT-2026-126685

Name of the Vulnerable Software and Affected Versions systeminformation versions prior to 5.33.13 Description On FreeBSD, OpenBSD, and NetBSD, the networkStatsifaces function in lib/network.js stores per-interface data in a plain-object cache. When the proto value is passed as the ifaces paramete...

Astra Linux - vulnerability in linux

An issue was found in Xen up to version 4.14.x. Some operating systems such as Linux, FreeBSD, and NetBSD process watch events using a single thread. If these events are received faster than the thread can handle them, they get queued. Since the queue is unbounded, a guest may be able to trigger ...

Astra Linux – Vulnerability in Linux

A issue was discovered in the kernel of NetBSD 7.1. An Access Point AP forwards EAPOL frames to other clients even though the sender has not yet successfully authenticated with the AP. This could be exploited in Wi-Fi networks to launch denial-of-service attacks against connected clients, and it...

CVE-2026-57843

NetBSD contains an information disclosure vulnerability in mmopen within sys/dev/mm.c that allows unprivileged local users to obtain real kernel virtual addresses by opening world-accessible devices such as /dev/null or /dev/zero, which incorrectly receive the PKKMEM process flag. Attackers can...

CVE-2026-57842

NetBSD contains a use-after-free and double-free vulnerability in msgrecvcopyin within the COMPATNETBSD32 compatibility layer due to a missing return statement before the cleanup label on the success path. Any local user able to execute a 32-bit binary on a 64-bit NetBSD system can trigger a kern...