30626 matches found
MAL-2026-11167 Malicious code in local-config-parser (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fa2dd509a9d17ced72d7119cf68768f7356d3f67af131e9cbe5bfe981a626ac4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MariaDB: Server crash (stack-overflow DoS) via unbounded recursion in MariaDB WKB GEOMETRYCOLLECTION parser
A server crash vulnerability was identified in the WKB GEOMETRYCOLLECTION parser of a database server. The parser employed unbounded recursion without depth limits or stack overflow checks when processing nested geometry collections, allowing crafted input with deeply nested structures to exhaust...
Malicious code in text-line-parser (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7e51069873e7107964bf35c4ad5deace11fd5269366791475b18d0426902749 The package advertises itself as a text/line parsing utility, but its shipped index.js contains only unrelated color-conversion stubs...
SUSE-SU-2026:3362-1 Security update for samba
This update for samba fixes the following issues - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server bsc1271672. - CVE-2026-15779: pamwinbind module with mkhomedir set allows chown of critical system paths without validation bsc1271469. - CVE-2026-58216: 6-byt...
Apache Struts 2 - Remote Command Execution Detection
Apache Struts 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 is susceptible to remote command injection attacks. The Jakarta Multipart parser has incorrect exception handling and error-message generation during file upload attempts, which can allow an attacker to execute arbitrary commands via a...
OSV-2026-1071 Security exception in com.github.javaparser.ast.expr.FieldAccessExpr.accept
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=537183300 Crash type: Security exception Crash state: com.github.javaparser.ast.expr.FieldAccessExpr.accept com.github.javaparser.ast.visitor.VoidVisitorAdapter.visit java.base/java.nio.ByteBuffer.position...
CVE-2026-59922
A flaw was found in Mistune, a Python Markdown parser. A remote attacker could exploit this vulnerability by providing specially crafted input containing specific marker pairs tilde, equals-sign, or caret. This crafted input causes the parser to perform quadratic work, leading to excessive CPU...
CVE-2026-59924
A flaw was found in Mistune, a Python Markdown parser. The Include.parse function does not properly verify user-supplied include paths, allowing an attacker to craft paths that can access files outside the intended markdown directory. This can lead to information disclosure when markdown files ar...
CVE-2026-51274
...
CVE-2026-51274
The CVE-2026-51274 entry relates to the schreibfaul1 ESP32-audioI2S 3.4.5 stack, where the heap-based buffer overflow occurs in the ID3v2 SYLT synchronized lyrics parser in audiolib. Root cause: missing bounds validation on attacker-controlled frame size and improper memory access during lyric pa...
PT-2026-65533
In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow in the ID3v2 SYLT synchronized lyrics parser in audiolib allows remote attackers to cause a denial of service application crash, information disclosure, or potential arbitrary code execution via a crafted MP3 file. The vulnerabili...
dovecot security update
1:2.3.16-8 - fix CVE-2026-42006: fix IMAP parser listcountlimit to correctly limit open braces instead of close braces RHEL-188480...
CVE-2026-54690: Server-Side Request Forgery (SSRF)
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.9.1 until 0.61.0, datamodel-code-generator silently dereferences attacker-controlled JSON Schema $ref HTTP or...
CVE-2026-51274
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
SUSE SLES16 Security Update : joe (SUSE-SU-2026:22843-1)
The remote SUSE Linux SLES16 / SLESSAP16 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:22843-1 advisory. This update for joe fixes the following issue - CVE-2026-13412: improper validation in tag-file parser can lead to arbitrary command...
TencentOS Server 3: python3 (TSSA-2026:0766)
The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0766 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...
EUVD-2026-49927
In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow in the ID3v2 SYLT synchronized lyrics parser in audiolib allows remote attackers to cause a denial of service application crash, information disclosure, or potential arbitrary code execution via a crafted MP3 file. The vulnerabili...
SUSE SLES16 Security Update : perl-DBI (SUSE-SU-2026:22845-1)
The remote SUSE Linux SLES16 / SLESSAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22845-1 advisory. - CVE-2026-15392: failure to validate symbolic links during table path resolution could allow unauthorized file reads and writes...
TencentOS Server 2: gstreamer1-plugins-bad-free, gstreamer1-plugins-base, and gstreamer1-plugins-good (TSSA-2026:0765)
The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0765 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...