43808 matches found
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: drm/xe: fixed NPD in bomeminfo When a buffer object is purged, its ttm.resource is set to NULL via the TTM pipeline. However, the BO remains in the client’s object list until userspace explicitly closes the GEM handle. If memory...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: netfs: Fixed netfscreatewritereq to handle the creation of async cache objects. netfscreatewritereq will skip caching if the fscache cookie is disabled. However, this is a problem because the async cache object creation might not...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: GPU: host1x – Allow entries in BO caches to be freed When a buffer object is pinned using host1xbopin, along with a cache, the resulting mapping is kept in the cache so it can be reused in subsequent pinnings. Each mapping holds ...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: The use-after-free issue in amdxdnagemdmabufmmap has been fixed. When vminsertpages fails, the error path calls vma-vmops-closevma. This call internally invokes drmgemvmclose, which in turn calls drmgemobjectput...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerabilities have been resolved: mm/slub: Actually fixed the issue with the freelist pointer and redzone allocation. It turns out that SLUB redzone allocation “slubdebug=Z” checks based on s-objectsize instead of s-inuse which is normally adjusted to make roo...
CVE-2026-53585
A flaw was found in libgit2. The gitdeltaapply function incorrectly trusts an attacker-controlled size value from a delta object header, which is used for memory allocation before proper validation of delta instructions. A remote attacker or local user can supply malicious pack data, for example,...
Malicious Package
Overview travel-core-utils-object is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
CVE-2026-78178
A vulnerability was determined in jQWidgets up to 24.0.1. This affects the function JQXLite.extend/jqxBaseFramework.extend of the file jqwidgets/jqx-all.js. This manipulation causes improperly controlled modification of object prototype attributes. The attack can be initiated remotely. The report...
CVE-2026-78179
CVE-2026-78179 affects rexrainbow phaser3-rex-notes (versions up to 1.80.17 ). The vulnerability resides in the SetValue function within plugins/utils/object/SetValue.js, part of the BehaviorTree Blackboard Data Interface component. By manipulating the key argument, an attacker can trigger protot...
CVE-2026-78179
A vulnerability was identified in rexrainbow phaser3-rex-notes up to 1.80.17. This vulnerability affects the function SetValue of the file plugins/utils/object/SetValue.js of the component BehaviorTree Blackboard Data Interface. Such manipulation of the argument key leads to improperly controlled...
CVE-2026-78178 jQWidgets jqx-all.js jqxBaseFramework.extend prototype pollution
A vulnerability was determined in jQWidgets up to 24.0.1. This affects the function JQXLite.extend/jqxBaseFramework.extend of the file jqwidgets/jqx-all.js. This manipulation causes improperly controlled modification of object prototype attributes. The attack can be initiated remotely. The report...
CVE-2026-71507: Authorization Bypass Through User-Controlled Key
Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated attackers with third-party creation rights to create, replace, or delete bank account details of any company without requiring read access ...
CVE-2026-67602: Use of Incorrectly-Resolved Name or Reference
phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to gain full API access by exploiting an insecure object cache keying mechanism. The cache is keyed by lookup value alone without including the searched column, enabling an...
PT-2026-80997
Name of the Vulnerable Software and Affected Versions Combodo iTop versions prior to 3.2.3 Description Combodo iTop is a web-based IT service management tool. The user preference functionality is susceptible to PHP object injection, a condition where untrusted input is passed to the PHP unseriali...
PT-2026-81000
Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks tha...
PT-2026-81002
Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated attackers with third-party creation rights to create, replace, or delete bank account details of any company without requiring read access ...
CVE-2026-40877: Deserialization of Untrusted Data
Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to PHP object injection in the user preference functionality, which can lead to remote code execution. This issue has been fixed in version 3.2.3...
CVE-2026-71505: Authorization Bypass Through User-Controlled Key
Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks tha...
Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...