Debian dsa-6394 : firefox-esr - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6394 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6394-1 [email protected] https://www.debian.org/securit...

PT-2026-63511

Name of the Vulnerable Software and Affected Versions danger danger-js versions prior to 13.0.8 Description An OS command injection issue exists in the CLI component within the danger.git.diffForFile function located in the source/platforms/git/localGetFileAtSHA.ts file. This occurs when the File...

VulnCheck KEV: CVE-2026-44825

Hardcoded credentials in the Basic Authentication setup tool bin/solr auth enable in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote attacker to gain full administrative access to the cluster via publicly known default credentials installed silently alongside the user-specifi...

Slackware Linux 15.0 / current mozilla-firefox Multiple Vulnerabilities (SSA:2026-202-02)

The version of mozilla-firefox installed on the remote host is prior to 140.13.0esr. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2026-202-02 advisory. New mozilla-firefox packages are available for Slackware 15.0 and -current to fix security issues. Tenable has...

Allocation of Resources Without Limits or Throttling

Overview io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the SpdyHttpDecoder. An attacker can...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the HAProxyMessageDecoder. An attacker can cause unbounded memory allocation by sending a specially crafted PROXY protocol v2 binary prefix with a version byte of 0xFF, which...

Incorrect Authorization

Overview io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients. Affected versions of this package are vulnerable to Incorrect Authorization in the CorsHandler. An attacker can gain unauthorized access to...

SUSE CVE-2026-56623

Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and server-side SSH. A git server implemented with Apache MINA SSHD component sshd-git and running on Windows could allow an authenticated remote user access to git repositories...

SUSE CVE-2026-56624

Improper certificate validation in Apache MINA SSHD server-side. Apache MINA SSHD is a Java library for client-side and server-side SSH. Server-side OpenSSH user certificate validation during user authentication in an Apache MINA SSHD server did not check for the unsupported force-command or...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection in the XmlDecoder file when XML input containing a DOCTYPE declaration is processed by an AsyncXMLInputFactory without security configuration, leaving DTD and entity handling enabled. An attacker can...

CVE-2026-16488

The CVE covers QUSETIONS MiniCode-Python 0.1.0 where the subprocess.Popen call in minicode/config.py of the Project File Handler is vulnerable to OS command injection. The issue can be exploited remotely with high attack complexity and no privileges required, though user interaction is indicated ...

CVE-2026-16488

A vulnerability was determined in QUSETIONS MiniCode-Python 0.1.0. This vulnerability affects the function subprocess.Popen of the file minicode/config.py of the component Project File Handler. Executing a manipulation can lead to os command injection. The attack may be launched remotely. A high...

CVE-2026-16488 QUSETIONS MiniCode-Python Project File config.py subprocess.Popen os command injection

A vulnerability was determined in QUSETIONS MiniCode-Python 0.1.0. This vulnerability affects the function subprocess.Popen of the file minicode/config.py of the component Project File Handler. Executing a manipulation can lead to os command injection. The attack may be launched remotely. A high...

Heap-based Buffer Overflow

Overview org.webjars.npm:sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the bundled libvips TIFF loader VipsForeignLoadTiff, which can...

Integer Overflow

Overview org.webjars.npm:sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images Affected versions of this package are vulnerable to Integer Overflow in the bundled libvips GIF loader VipsForeignLoadNsgif, which can miscompute...

sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591

Impact A number of vulnerabilities, two rated as "High" severity using CVSSv4, have been discovered and fixed in the upstream libvips dependency. Those processing untrusted input with versions of sharp prior to 0.35.0 are affected. Patches Using prebuilt binaries provided by sharp? Most people re...

Integer Overflow

Overview org.webjars.npm:sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images Affected versions of this package are vulnerable to Integer Overflow leading to a heap buffer overflow in the bundled libvips VIPS loader...

Out-of-bounds Read

Overview org.webjars.npm:sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images Affected versions of this package are vulnerable to Out-of-bounds Read and null pointer dereference in the bundled libvips EXIF decoder, which doe...

Integer Overflow

Overview sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images Affected versions of this package are vulnerable to Integer Overflow leading to a heap buffer overflow in the bundled libvips VIPS loader VipsForeignLoadVips, whi...

Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake

Summary A WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header leaks memory permanently. The request's IncomingMessage is retained in an internal map and a pending promise is never settled, even though no connection is established. Since the...