266087 matches found
AlmaLinux 9.2 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1790252886)
The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1790252886 advisory. - brace-expansion through 5.0.6 is vulnerable to denial of service. The expand function exhibits exponential-time complexity in the...
-llscw-react-cli (>=1.0.0, <=1.1.0), 002-node-cli (1.0.0) +21693 more potentially affected by CVE-2026-101894 via decompress (>=4.0.0, <=4.2.1)
decompress NPM version =4.0.0, =1.0.0, =0.0.1, =1.0.0, =2.2.0-alpha.3 and more Source cves: CVE-2026-101894 Source advisory: GHSA-HRH2-VP3X-79XF...
CVE-2026-103042
LightLLM through 1.2.0 contains a memory exhaustion vulnerability in the NCCL control channel when started with --pdtransmode nccl, allowing unauthenticated attackers to exhaust KV-transfer worker memory. Attackers can call the exposedsetvalue method to store unbounded key-value pairs without siz...
CVE-2026-103042
LightLLM through version 1.2.0 is susceptible to a memory exhaustion vulnerability within the NCCL control channel. When the system is started with the --pd_trans_mode nccl flag, unauthenticated attackers can exploit the exposed exposed_set_value method. Because this method lacks size limits, it ...
CVE-2026-103042 LightLLM through 1.2.0 Unauthenticated Memory Exhaustion via NCCL Control Channel set_value
LightLLM through 1.2.0 contains a memory exhaustion vulnerability in the NCCL control channel when started with --pdtransmode nccl, allowing unauthenticated attackers to exhaust KV-transfer worker memory. Attackers can call the exposedsetvalue method to store unbounded key-value pairs without siz...
CVE-2026-103042 LightLLM through 1.2.0 Unauthenticated Memory Exhaustion via NCCL Control Channel set_value
LightLLM through 1.2.0 contains a memory exhaustion vulnerability in the NCCL control channel when started with --pdtransmode nccl, allowing unauthenticated attackers to exhaust KV-transfer worker memory. Attackers can call the exposedsetvalue method to store unbounded key-value pairs without siz...
CVE-2026-97947
A flaw was found in the Linux kernel's x86 AMD node component, which may lead to a Denial of Service DoS. If initialization of the AMD System Management Network SMN interface fails, exported read and write functions remain accessible without validating that internal device structures were...
Malicious code in @chatunity/baileys (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acc8739717b3768c51a56da3a23b85b253b0bc08a2ab4a447e278d055c8a2e70 This package presents itself as a fork of the Baileys WhatsApp library. On every successful login through makeWASocket, lib/Socket/socket.js invokes...
GO-2026-6507 vulnerabilities
Vulnerabilities for packages: kubernetes-dns-node-cache-fips, juicefs, k8sgateway, kubernetes-dns-node-cache, k8sgateway-fips, eks-distro, eks-distro-fips...
GO-2026-6507 vulnerabilities
Vulnerabilities for packages: juicefs, kubernetes-dns-node-cache, k8sgateway...
0g-aura (>=0.1.0, <=0.4.31), 0g-kit (>=1.0.0, <=1.0.9) +16353 more potentially affected by CVE-2026-92000 via adm-zip (>=0.1.4, <=0.6.0)
adm-zip NPM version =0.1.4, =0.1.0, =1.0.0, =0.1.0, =0.2.9, =3.0.0-rc.0, =1.125.0, =1.2.2, =1.0.0, =1.0.0, =1.0.1, =1.0.10 and more Source cves: CVE-2026-92000 Source advisory: OSV:GHSA-RCW4-F5RP-G42V...
0g-aura (>=0.1.0, <=0.4.31), 0g-kit (>=1.0.0, <=1.0.9) +16353 more potentially affected by CVE-2026-102282 via adm-zip (>=0.1.4, <=0.6.0)
adm-zip NPM version =0.1.4, =0.1.0, =1.0.0, =0.1.0, =0.2.9, =3.0.0-rc.0, =1.125.0, =1.2.2, =1.0.0, =1.0.0, =1.0.1, =1.0.10 and more Source cves: CVE-2026-102282 Source advisory: SNYK:JS-ADMZIP-20335419...
0g-aura (>=0.1.0, <=0.4.31), 0g-kit (>=1.0.0, <=1.0.9) +16353 more potentially affected by CVE-2026-102282 via adm-zip (>=0.1.4, <=0.6.0)
adm-zip NPM version =0.1.4, =0.1.0, =1.0.0, =0.1.0, =0.2.9, =3.0.0-rc.0, =1.125.0, =1.2.2, =1.0.0, =1.0.0, =1.0.1, =1.0.10 and more Source cves: CVE-2026-102282 Source advisory: GHSA-J5F4-CC29-5X44...
ROOT-APP-NPM-CVE-2026-44290 CVE-2026-44290 in protobufjs - Patched by Root
Root has patched CVE-2026-44290 in the protobufjs package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-45740 CVE-2026-45740 in protobufjs - Patched by Root
Root has patched CVE-2026-45740 in the protobufjs package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-44289 CVE-2026-44289 in protobufjs - Patched by Root
Root has patched CVE-2026-44289 in the protobufjs package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-41673 CVE-2026-41673 in @xmldom/xmldom - Patched by Root
Root has patched CVE-2026-41673 in the @xmldom/xmldom package for Root:npm. Multiple fixed versions available...
CLEANSTART-2026-BZ98480 undici's experimental WebSocketStream client crashes the whole Node
Security vulnerability affects the langfuse package. undici's experimental WebSocketStream client crashes the whole Node...