CVE-2026-82858

@hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient provenance validation, causing untrusted reconciliation input to be treated as trusted. An attacker can supply malicious execute plans that bypass security checks and perform unsafe reconciliation oper...

seans-surf-and-skate

Sean's Surf & Skate Co. — सील सिक्योरिटी डेमो Maven / Java स्प्रिंग बूट के साथ बनाया गया एक छोटा लेकिन वास्तविक दिखने वाला ई-कॉमर्स स्टोरफ्रंट "Sean's Surf & Skate Co."। यह ज्ञात कमज़ोरियों वाली ओपन-सोर्स डिपेंडेंसियों के साथ आता है ताकि इसका उपयोग यह प्रदर्शित करने के लिए किया जा सके कि Seal...

Linux Distros Unpatched Vulnerability : CVE-2026-59280

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from...

Linux Distros Unpatched Vulnerability : CVE-2026-59314

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file...

DEBIAN-CVE-2026-82417

Summary qs.stringify throws a TypeError when it serializes an object whose own constructor property has a truthy, non-callable isBuffer member. utils.isBuffer duck-types buffers by calling obj.constructor.isBufferobj after checking only that the property is truthy, so a value such as constructor:...

AZL-98334 CVE-2026-82417 affecting package nodejs-nodemon 2.0.3-5

Summary qs.stringify throws a TypeError when it serializes an object whose own constructor property has a truthy, non-callable isBuffer member. utils.isBuffer duck-types buffers by calling obj.constructor.isBufferobj after checking only that the property is truthy, so a value such as constructor:...

AZL-98331 CVE-2026-82417 affecting package js-jquery 3.5.0-4

Summary qs.stringify throws a TypeError when it serializes an object whose own constructor property has a truthy, non-callable isBuffer member. utils.isBuffer duck-types buffers by calling obj.constructor.isBufferobj after checking only that the property is truthy, so a value such as constructor:...

CVE-2026-82417

Summary qs.stringify throws a TypeError when it serializes an object whose own constructor property has a truthy, non-callable isBuffer member. utils.isBuffer duck-types buffers by calling obj.constructor.isBufferobj after checking only that the property is truthy, so a value such as constructor:...

CVE-2019-14319

creationtimestamp| type| source ---|---|--- 2026-08-29 23:00:08+00:00| seen| Telegram/lHKFDBRntVLEnzL4VqEuPiY-Vt8pAa9hTd9KwEhxyXdixQ 2026-08-30 00:00:12+00:00| seen| Telegram/lHKFDBRntVLEnzL4VqEuPiY-Vt8pAa9hTd9KwEhxyXdixQ 2026-08-31 00:00:46+00:00| published-proof-of-concept|...

CVE-2026-55378 JS Recon: Command injection in PR Branch Checker workflow via untrusted pull request context values

JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/prchecker.yml places github.headref and github.event.pullrequest.head.repo.fullname into BRANCHNAME and SOURCEREPO and interpolates those untrusted values...

SUSE CVE-2026-80670

In the Linux kernel, the following vulnerability has been resolved: perf tools: Use perfenvgetcputopology in machineresolve machineresolve accesses env-cpual-cpu.socketid after checking al-cpu = 0 and env-cpu != NULL, but without validating al-cpu against env-nrcpusavail. Since al-cpu comes from...

BIT-APISIX-2026-63041 Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers

Reliance on Untrusted Inputs in a Security Decision vulnerability in Apache APISIX. This vulnerability allows an attacker to escalate privilege or perform an authorization bypass by sending certain values that the attach-consumer-label plugin does not sanitise correctly. This issue affects Apache...

CVE-2026-80671

In the Linux kernel, the following vulnerability has been resolved: perf sched: Fix registerpid overflow, strcpy, and BUGON registerpid has several issues when processing untrusted perf.data: 1. Integer overflow: pid + 1 sizeofstruct taskdesc can wrap to a small value on 32-bit systems when pid i...

CVE-2026-80671

In the Linux kernel, the following vulnerability has been resolved: perf sched: Fix registerpid overflow, strcpy, and BUGON registerpid has several issues when processing untrusted perf.data: 1. Integer overflow: pid + 1 sizeofstruct taskdesc can wrap to a small value on 32-bit systems when pid i...

UBUNTU-CVE-2026-80671

In the Linux kernel, the following vulnerability has been resolved: perf sched: Fix registerpid overflow, strcpy, and BUGON registerpid has several issues when processing untrusted perf.data: 1. Integer overflow: pid + 1 sizeofstruct taskdesc can wrap to a small value on 32-bit systems when pid i...

CVE-2026-80670 perf tools: Use perf_env__get_cpu_topology() in machine__resolve()

In the Linux kernel, the following vulnerability has been resolved: perf tools: Use perfenvgetcputopology in machineresolve machineresolve accesses env-cpual-cpu.socketid after checking al-cpu = 0 and env-cpu != NULL, but without validating al-cpu against env-nrcpusavail. Since al-cpu comes from...

CVE-2026-80671 perf sched: Fix register_pid() overflow, strcpy, and BUG_ON

In the Linux kernel, the following vulnerability has been resolved: perf sched: Fix registerpid overflow, strcpy, and BUGON registerpid has several issues when processing untrusted perf.data: 1. Integer overflow: pid + 1 sizeofstruct taskdesc can wrap to a small value on 32-bit systems when pid i...

Linux Distros Unpatched Vulnerability : CVE-2026-65979

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.1...

CVE-2026-80179

A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption JWE token containing numerous period delimiters. This malformed token can force the JWE.deserialize function to allocate excessive memory, leading to a MemoryError. This issue results in a denial of...

CVE-2026-81522

A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed at a different...