CVE-2025-12801

A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the privileges assigned to it in the /etc/exports file at mount time. In particular, it allows the client to access any subdirectory or subtree of an exporte...

CVE-2026-29022

A flaw was found in drlibs. A remote attacker can exploit this heap buffer overflow vulnerability by providing a specially crafted WAV file. This occurs due to a mismatch in sampleLoopCount validation, allowing memory corruption and potentially leading to arbitrary code execution or denial of...

MINI-RF35-XCRC-546J

Bulletin has no description...

MINI-R235-HCJJ-M4VJ

Bulletin has no description...

MINI-875R-J27C-HHQM

Bulletin has no description...

Linux Distros Unpatched Vulnerability : CVE-2025-15599

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by...

Linux Distros Unpatched Vulnerability : CVE-2026-3195

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in QEMU. When reading input audio in the virtio-snd device input callback, the virtiosndpcmincb function did not check whether the iov could fi...

Linux Distros Unpatched Vulnerability : CVE-2025-64736

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An out-of-bounds read vulnerability exists in the ABF parsing functionality of The Biosig Project libbiosig 3.9.2 and Master Branch 5462afb0. A specially crafte...

CVE-2026-0540

A cross site scripting flaw has been discovered in the DOMPurify npm library. This flaw allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements noscript, xmp, noembed, noframes, iframe in the SAFEFORXML regex. Attackers can include payloads like in attribute...

CVE-2025-15599

A flaw was found in DOMPurify, a library designed to prevent web vulnerabilities. A remote attacker can exploit a cross-site scripting XSS vulnerability by bypassing the library's sanitization process. This bypass is possible due to improper validation of textarea rawtext elements, allowing...

CVE-2026-25674

A flaw was found in Django. A race condition in the file-system storage and file-based cache backends allows an attacker to create file system objects with incorrect permissions. This vulnerability arises from concurrent requests in multi-threaded environments, where a temporary umask change in o...

CVE-2026-3449

A flaw was found in @tootallnate/once. When the AbortSignal option is used, a Promise can remain in a permanently pending state after the signal is aborted. This incorrect control flow scoping can lead to stalled requests, blocked workers, or degraded application availability. Mitigation Mitigati...

CVE-2026-3336

A flaw was found in aws-lc, a cryptographic library. An unauthenticated attacker can exploit improper certificate validation within the PKCS7verify function. This allows them to bypass the verification process for certificate chains when handling PKCS7 objects that contain multiple digital signer...

CVE-2026-2376

A flaw was found in mirror-registry where an authenticated user can trick the system into accessing unintended internal or restricted systems by providing malicious web addresses. When the application processes these addresses, it automatically follows redirects without verifying the final...

CVE-2026-3338

A flaw was found in AWS-LC. An unauthenticated user can bypass signature verification when processing PKCS7 objects with Authenticated Attributes due to improper signature validation in the PKCS7verify function. This vulnerability allows an attacker to potentially compromise the integrity of sign...

Linux Distros Unpatched Vulnerability : CVE-2026-2634

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Malicious scripts could cause desynchronization between the address bar and web content before a response is received in Firefox iOS, allowing attacker-controll...

CVE-2026-3442

A flaw was found in GNU Binutils. This vulnerability, a heap-based buffer overflow, specifically an out-of-bounds read, exists in the bfd linker component. An attacker could exploit this by convincing a user to process a specially crafted malicious XCOFF object file. Successful exploitation may...

CVE-2026-3441

A flaw was found in GNU Binutils. This heap-based buffer overflow vulnerability, specifically an out-of-bounds read in the bfd linker, allows an attacker to gain access to sensitive information. By convincing a user to process a specially crafted XCOFF object file, an attacker can trigger this...

CVE-2026-3429

A flaw was identified in the Account REST API of Keycloak that allows a user authenticated at a lower security level to perform sensitive actions intended only for higher-assurance sessions. Specifically, an attacker who has already obtained a victim’s password can delete the victim’s registered...

PT-2026-22627

Name of the Vulnerable Software and Affected Versions ZimaOS versions prior to 1.5.1 Description ZimaOS, a fork of CasaOS, is susceptible to a flaw stemming from inadequate validation or restriction of target URLs. An authenticated local user can construct requests that target internal IP...