161 matches found
Uncaught Exception
Overview ddtrace is a Datadog APM client library Affected versions of this package are vulnerable to Uncaught Exception via moduloaspect in the IAST taint-tracking C++ extension, when a lone surrogate character is passed as a format argument to the % modulo string operator. The unhandled surrogat...
UBUNTU-CVE-2026-116541
Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcnwritetobytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail...
CVE-2026-116541 netty-tcnative before 2.0.84.Final Denial of Service via BIO Write Overcount
Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcnwritetobytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail...
CVE-2026-116541
Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcnwritetobytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail...
EUVD-2026-109911
Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcnwritetobytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail...
PT-2026-123394
Content removed...
Node.js DNS resolveAny Process Abort
Node.js versions 22.x, 24.x, and 26.x contain a flaw where dns.resolveAny can abort the process when a DNS response has more than 256 A records. The supplied offline checker compares reported version evidence against fixed releases...
Node.js DNS resolveAny Process Abort
Node.js versions 22.x, 24.x, and 26.x contain a flaw where dns.resolveAny can abort a process when DNS responses contain more than 256 A records. This submission provides source-backed research and an implementation plan; it contains no checker or proof of concept...
Exploit for CVE-2026-58042
node-cve-2026-58042-check Standal...
Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: freerdp (UTSA-2026-130071)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130071 advisory. FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rtsreadresult function within the RPC gateway transport parser. Attackers can send a malicious...
CVE-2026-109242
FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile-current buffer is allocated without zeroing. A malicious RDP server can send a crafted WBTTILEFIRST then WBTTILEUPGRADE sequence to paint heap bytes onscreen or abort...
EulerOS 2.0 SP13 : glibc (EulerOS-SA-2026-4049)
According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Calling wordexp with WRDEAPPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the wewordv...
EulerOS 2.0 SP11 : glibc (EulerOS-SA-2026-4321)
According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : When expanding paths that begin with a tilde followed by a username, the internal parsetilde function extracts the username to determine the user's...
CVE-2026-109242: Use of Uninitialized Resource
FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile-current buffer is allocated without zeroing. A malicious RDP server can send a crafted WBTTILEFIRST then WBTTILEUPGRADE sequence to paint heap bytes onscreen or abort...
RLSA-2026:79281 Moderate: glibc security, bug fix, and enhancement update
The glibc packages provide the standard C libraries libc, POSIX thread libraries libpthread, standard math libraries libm, and the name service cache daemon nscd used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fixes: glibc:...
NPM: music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort
NPM: music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort vulnerability discovered by ? in WordPress Npm music-metadata versions 11.16.0...
music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort
Summary The Matroska/WebM EBML parser decodes attacker-controlled variable-length integer VINT element lengths without first validating that the declared element fits within its enclosing container or the available input. Leaf lengths are then used directly for string-token and Uint8Array...
GHSA-5GFJ-9Q3V-QFP3 music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort
Summary The Matroska/WebM EBML parser decodes attacker-controlled variable-length integer VINT element lengths without first validating that the declared element fits within its enclosing container or the available input. Leaf lengths are then used directly for string-token and Uint8Array...
CVE-2026-107389
The music-metadata metadata parser for audio and video media files is vulnerable to memory exhaustion or process aborts in versions prior to 11.16.0 . The Matroska and WebM EBML parsers fail to validate that a decoded VINT element length fits within its parent or the available input before alloca...
EUVD-2026-95238
music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the Matroska and WebM EBML parser decodes an attacker-controlled VINT element length and uses it for string-token or Uint8Array allocation before confirming that the leaf fits within its parent or available...