23728 matches found
CVE-2026-42586
CVE-2026-42586 affects Netty up to 4.2.13.Final and 4.1.133.Final where the RedisEncoder writes user-controlled strings to the output buffer without sanitizing CRLF (\n). Because RESP uses CRLF as command/response delimiters, an attacker who controls Redis message content can inject arbitrary Red...
CVE-2026-44005 vm2: Sandbox escape
vm2 is an open source vm/sandbox for Node.js. From 3.9.6 to 3.10.5, vm2's bridge exposes mutable proxies for real host-realm intrinsic prototypes and then forwards sandbox writes into the underlying host objects with otherReflectSet and otherReflectDefineProperty, which lets attacker-controlled...
Updated kernel, kmod-virtualbox & kmod-xtables-addons packages fix security vulnerability
Upstream kernel version 6.6.138 fixes a vulnerability. The kmod-virtualbox & kmod-xtables-addons packages have been updated to work with this new kernel...
SUSE CVE-2022-48629
In the Linux kernel, the following vulnerability has been resolved: crypto: qcom-rng - ensure buffer for generate is completely filled The generate function in struct rngalg expects that the destination buffer is completely filled if the function returns 0. qcomrngread can run into a situation...
CVE-2026-44294 protobufjs: Denial of service from crafted field names in generated code
protobufjs compiles protobuf definitions into JavaScript JS functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript property accessors from schema-controlled field and oneof names. Certain control characters in field names were not escaped before being embedded into generated functio...
CVE-2026-44292 protobufjs: Prototype injection in generated message constructors
protobufjs compiles protobuf definitions into JavaScript JS functions. Prior to 7.5.6 and 8.0.2, protobufjs generated message constructors copied enumerable properties from a provided properties object without filtering the proto key. If an application constructed a message from an...
CVE-2026-44290 protobufjs: Process-wide denial of service through unsafe option paths
protobufjs compiles protobuf definitions into JavaScript JS functions. Prior to 7.5.6 and 8.0.2, protobufjs allowed certain schema option paths to traverse through inherited object properties while applying options. A crafted protobuf schema or JSON descriptor could cause option handling to write...
CVE-2026-28930
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.5. An app may be able to access protected user data...
RHSA-2026:16693 Red Hat Security Advisory: jq security update
Bulletin has no description...
CLSA-2026-1778604436 libtasn1: Fix of CVE-2018-6003
CVE-2018-6003: Restrict recursion depth in asn1decodesimpleber to prevent stack exhaustion DoS via crafted indefinite-length BER input...
CLSA-2026-1778604245 samba: Fix of CVE-2022-32742
CVE-2022-32742: fix server memory information leak via SMB1; insufficient range-check on SMB1 write request length allowed server memory contents to leak into the written file or printer instead of client-supplied bytes...
CVE-2026-28951
An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to gain root privileges...
MGASA-2026-0128 Updated sed packages fix security vulnerability
Race Condition in GNU Sed. CVE-2026-5958...
SUSE CVE-2026-7814
Stored cross-site scripting XSS vulnerability in pgAdmin 4 Browser Tree and Explain Visualizer modules. User-controlled PostgreSQL object names database, schema, table, column, etc. were assigned to DOM elements via innerHTML, allowing crafted object names containing HTML markup to execute...
PT-2026-40825
Name of the Vulnerable Software and Affected Versions ERPNext versions prior to 15.102.0 ERPNext versions prior to 16.11.0 Description Certain endpoints fail to enforce proper authorization checks, which allows users to modify data beyond the permissions assigned to their role. Recommendations...
OPENSUSE-SU-2026:10773-1 perl-CryptX-0.89.0-1.1 on GA media
These are all security issues fixed in the perl-CryptX-0.89.0-1.1 package on the GA media of openSUSE Tumbleweed...
Important: jq security update
jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar applications allow you to manipulate text. Security Fixes: jq: out-of-bounds read in...
OpenImageIO-3.1.13.1-2.1 on GA media (moderate)
OpenImageIO-3.1.13.1-2.1 on GA media Announcement ID: openSUSE-SU-2026:10752-1 Rating: moderate Cross-References: CVE-2026-7582 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...
CVE-2026-43680
A Remote Code Execution vulnerability in Claris FileMaker Cloud allowed a user with Admin Console privileges to bypass a front-end restriction on OS Script schedule types and execute arbitrary operating system commands on the underlying host. This issue is fixed in FileMaker Cloud 2.22.0.5...