vm2: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks

Summary vm2 current head v3.11.5, commit 7a1f5100b96f48d34e0fe104ab37c0acc5944f92 still exposes registered Node.js internal symbols from host WebStream prototypes to sandbox code. The prior nodejs. symbol hardening blocks Symbol.for'nodejs.' at the source, but the extraction filters and bridge...

NPM: vm2: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks

NPM: vm2: Incomplete nodejs. symbol filtering lets sandbox override host WebStream state checks vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.4, = 3.11.6...

GHSA-JF8Q-945G-9Q4C vm2: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks

Summary vm2 current head v3.11.5, commit 7a1f5100b96f48d34e0fe104ab37c0acc5944f92 still exposes registered Node.js internal symbols from host WebStream prototypes to sandbox code. The prior nodejs. symbol hardening blocks Symbol.for'nodejs.' at the source, but the extraction filters and bridge...

CVE-2026-Termius

Termius macOS 애플리케이션 취약점 보고서 CVE-2026-Termius 대상 : Termius macOS 테스트 버전 : 최신 2026년 1월 기준 영향 : 원격 코드 실행 RCE, 로컬 권한 상승 LPE, 앱 보안 우회 🚨 실행 요약 Termius macOS 애플리케이션에서 공격자가 다음을 수행할 수 있게 하는 세 가지 심각한 취약점이 발견되었습니다: 1. 임의 시스템 명령 실행 RCE : 렌더러에 노출된 숨겨진 백도어 Symbol을 통해. 2. 저장된 모든 비밀번호 덤프 LPE : 노출된 keytar 네이티브 모...

Resource Exhaustion

Apache Qpid ProtonJ2 is vulnerable to resource exhaustion. The vulnerability is due to unbounded symbol value caching, where symbol values are cached without size limits and a pre-authentication attacker can send crafted input to exhaust resources, leading to denial of service...

Rocky Linux 8 [CIQ] Security Update: protobuf / protobuf-compiler / protobuf-compiler-debuginfo / etc (crlsa-2022_7464)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20227464 advisory. protobuf: Incorrect parsing of nullchar in the proto symbol leads to Nullptr dereference CVE-2021-22570 Tenable has extracted the preceding description block direct...

Rocky Linux 8 [CIQ] Security Update: aspnetcore-runtime-6.0 / aspnetcore-targeting-pack-6.0 / dotnet / etc (crlsa-2022_5046)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20225046 advisory. dotnet: NuGet Credential leak due to loss of control of third party symbol server domain CVE-2022-30184 Tenable has extracted the preceding description block direct...

Rocky Linux 8 [CIQ] Security Update: aspnetcore-runtime-3.1 / aspnetcore-targeting-pack-3.1 / etc (crlsa-2022_5061)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20225061 advisory. dotnet: NuGet Credential leak due to loss of control of third party symbol server domain CVE-2022-30184 Tenable has extracted the preceding description block direct...

Denial Of Service

Apache Qpid Proton-J is vulnerable to denial of service. The vulnerability is due to unbounded symbol value caching, where the cache can grow without limit and a pre-authentication attacker can send crafted data to exhaust resources, leading to denial of service...

Important: crash

Issue Overview: A flaw was found in GDB's STABS debug format parser. The readmemberfunctions function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in...

CVE-2026-46595-proof

CVE-2026-46595 の証明 https://vulners.com/cve/CVE-2026-46595 は https://pkg.go.dev/vuln/GO-2026-5023 です。 2番目のリンクに記載されているとおり、golang.org/x/crypto/ssh の NewServerConn シンボルにおける脆弱性です。 このリポジトリには、脆弱性チェックが陽性となることを示す簡単なプログラムが含まれています。 最小限の golang.org/x/crypto/ssh サーバーを x/crypto v0.51.0 （ v0.52.0）に固定したもので、...

vol-rs

vol-rs A port of the Volatility 3 memory forensics framework from Python to Rust. It reads the same memory images, runs the same plugins with the same options, and prints the same output, byte for byte, a good deal faster. License This project is a port of Volatility 3 and is therefore an...

bochs_linux_kernel_debugging

bochslinuxkerneldebugging Bochs上でのLinuxカーネルデバッグ用ツール（シンボル、ネイティブBochsデバッガ、IDA PROを含む） Linuxカーネルデバッグ用のシンボルファイルを生成する 以下の手順に従ってください： 0- nm形式のデバッグ情報ファイルを生成する デバッグカーネルイメージに対してnm コマンドを使用するだけです。Debianの例： 1- dbgイメージをインストールする root@debian apt-get install linux-image-$uname -r-dbg 2- dbgイメージでnmが動作するか確認する：...

qpid-proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching

A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit an issue with unbounded symbol value caching. This could lead to resource exhaustion, where the system runs out of available resources, ultimately causing a denial of service DoS. A denial ...

CVE-2026-96269

A flaw was found in GNU Emacs. A remote attacker could achieve arbitrary code execution by tricking a user into opening a specially crafted file. This vulnerability arises because an untrusted value of read-symbol-shorthands affects the intern and unintern functions, allowing for code execution...

Linux Distros Unpatched Vulnerability : CVE-2026-96269

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and...

CVE-2026-96269

GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and unintern functions. This affects the default configuration; no particular user settings are required to trigger it...

DEBIAN-CVE-2026-96269

GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and unintern functions. This affects the default configuration; no particular user settings are required to trigger it...

AZL-103410 CVE-2026-96269 affecting package emacs 29.4-6

GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and unintern functions. This affects the default configuration; no particular user settings are required to trigger it...

UBUNTU-CVE-2026-96269

GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and unintern functions. This affects the default configuration; no particular user settings are required to trigger it...