630060 matches found
Astra Linux – Vulnerability in opensc
A vulnerability was discovered in OpenSC. This security flaw causes a buffer overflow vulnerability in the cardoshaveverifyrcpackage function. An attacker can provide a smart card package with malformed ASN1 data. The cardoshaveverifyrcpackage function scans the ASN1 buffer for two tags, but the...
Astra Linux – Vulnerability in rpm
A flaw was discovered in RPM’s signature check functionality when reading a package file. This flaw allows an attacker who can persuade a victim to install a seemingly verifiable package, whose signature header was modified, to cause corruption of the RPM database and execute malicious code. The...
CLSA-2026-1789384355 TuxCare security update for 204 packages (1 CVE)
TuxCare rebuilt 204 packages to address 1 CVE. Fixed in 2.28.0-tuxcare.1...
@aliceo2/bookkeeping (>=1.19.0, <=1.20.0), @beyondnet/evolith-cli (>=1.2.0, <=1.3.2) +67 more potentially affected by CVE-2026-88932 via multer (>=2.2.0, <=2.3.0)
multer NPM version =2.2.0, =1.19.0, =1.2.0, =1.2.0, =2026.7.0, =5.7.5, =11.1.29-depup.0, =0.1.0, =0.1.0, =11.0.62, =1.2.34, =12.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.1 and more Source cves: CVE-2026-88932 Source advisory: SNYK:JS-MULTER-19785644...
ROOT-APP-NPM-CVE-2026-44489 CVE-2026-44489 in axios - Patched by Root
Root has patched CVE-2026-44489 in the axios package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-63376 CVE-2026-63376 in toml - Patched by Root
Root has patched CVE-2026-63376 in the toml package for Root:npm. Multiple fixed versions available...
CLSA-2026-1789379074 TuxCare security update for io.netty (22 CVEs)
TuxCare rebuilt 46 io.netty packages to address 22 CVEs. Fixed in 4.1.79.Final-tuxcare.4...
CLSA-2026-1789377089 TuxCare security update for org.springframework (4 CVEs)
TuxCare rebuilt 23 org.springframework packages to address 4 CVEs. Fixed in 5.2.0.RELEASE-tuxcare.5...
ROOT-APP-NPM-CVE-2026-42040 CVE-2026-42040 in axios - Patched by Root
Root has patched CVE-2026-42040 in the axios package for Root:npm. Multiple fixed versions available...
CLSA-2026-1789376303 TuxCare security update for 3 packages (1 CVE)
TuxCare rebuilt 3 packages to address 1 CVE. Fixed in 3.2.11-tuxcare.5...
CLSA-2026-1789369685 TuxCare security update for org.springframework.graphql (1 CVE)
TuxCare rebuilt 2 org.springframework.graphql packages to address 1 CVE. Fixed in 1.2.9-tuxcare.6...
CLSA-2026-1789368896 TuxCare security update for 2 packages (1 CVE)
TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 2.22.4.post9+tuxcare...
net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...
golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...
[SECURITY] Fedora 45 Update: rust-hickory-net-0.26.2-1.fc45
Hickory-net is a safe and secure low-level DNS library. This is the foundational DNS protocol library used by the other higher-level Hickory DNS crates...
MAL-2026-16202 Malicious code in webpackbootstrapscripts (npm)
[email protected] typosquats bootstrap and ships a disguised in-browser proxy kit. Its bundled loader index-z2b7r4.js XOR-decodes a list of endpoints with a fixed key and injects remote scripts from https://dyingefforlessefforlessours.com via document.head.appendChild, then boots a...
Medium: composer
Issue Overview: Package bin path can escape the package directory, bypassing the GHSA-gjfg-22fp-rrxx fix. A malicious or compromised Composer package could, when installed as a dependency, cause Composer to change the permissions of a file outside that package's own directory and to register a...
CVE-2026-89021: Improper Link Resolution Before File Access
MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the container package OCI/tar image extraction that allows attackers to write files outside the container root by supplying a crafted container image with symlinks pointing to arbitrary paths. Attackers can exploit...
Malicious code in webpackbootstrap5 (npm)
[email protected] typosquats bootstrap and ships a disguised in-browser proxy kit. Its bundled loader index-z2b7r4.js XOR-decodes a list of endpoints with a fixed key and injects remote scripts from https://dyingefforlessefforlessours.com via document.head.appendChild, then boots a...
Malicious code in webpackbootstrapscripts (npm)
[email protected] typosquats bootstrap and ships a disguised in-browser proxy kit. Its bundled loader index-z2b7r4.js XOR-decodes a list of endpoints with a fixed key and injects remote scripts from https://dyingefforlessefforlessours.com via document.head.appendChild, then boots a...