247259 matches found
vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape
Summary On Node.js 24 and newer, vm2 can expose the host node:test module to sandboxed NodeVM code when the embedder explicitly allows the node:test builtin. Sandbox code can reach that module through require'node:node:test' and call run with attacker-controlled execArgv. node:test.run starts a...
vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts
Summary The vm2 command-line tool installed by npm install -g vm2 and documented in the README's "CLI" section runs the supplied script under NodeVM with require:external:true and no root / context / builtin configured. With these defaults the resolver loads every relative or absolute require...
GHSA-JXXV-8R27-VM4P vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts
Summary The vm2 command-line tool installed by npm install -g vm2 and documented in the README's "CLI" section runs the supplied script under NodeVM with require:external:true and no root / context / builtin configured. With these defaults the resolver loads every relative or absolute require...
Critical: Red Hat Security Advisory: Satellite 6.19.5 Async Update
A new release is now available for Red Hat Satellite 6.19 for RHEL 9. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...
EUVD-2026-90854
Editor PHP Object Injection in Hide Shipping Method For WooCommerce = 1.5.4 versions...
FreeRDP: FreeRDP: Remote code execution or client crash via malicious TS Gateway
A flaw was found in FreeRDP. FreeRDP clients using TS Gateway are vulnerable to a heap-buffer-overflow. A malicious gateway can send a specially crafted response fragment, causing the client to write beyond its allocated buffer. This can lead to a client crash, resulting in a Denial of Service Do...
WordPress Kirki plugin <= 6.3.1 - Arbitrary Code Execution vulnerability
Arbitrary Code Execution vulnerability discovered by Dthangws in WordPress Plugin Kirki versions = 6.3.1...
ghostscript: ghostscript: Heap buffer overflow via JPEG 2000 output adapter
A flaw was found in Ghostscript. This heap-based buffer overflow vulnerability in the JPEG 2000 output adapter allows an attacker to cause memory corruption by supplying a specially crafted PDF file. The crafted PDF contains a JPEG 2000 image with mismatched component subsampling factors...
CVE-2026-103680
A flaw was found in tnef. A heap-based buffer overflow can occur in the findfreenumber function when generating numbered backup suffixes for duplicate filenames. When numbered backups are enabled and file overwriting is disabled, an attacker can supply a specially crafted Transport Neutral...
CVE-2026-103680
A heap-based buffer overflow vulnerability exists in the tnef component within the find_free_number() function. The flaw is triggered during the generation of numbered backup suffixes for duplicate filenames. If numbered backups are enabled and file overwriting is disabled, an attacker can provid...
CVE-2026-103680 Tnef: heap buffer overflow in find_free_number() via numbered-backup suffix generation
A flaw was found in tnef. A heap-based buffer overflow can occur in the findfreenumber function when generating numbered backup suffixes for duplicate filenames. When numbered backups are enabled and file overwriting is disabled, an attacker can supply a specially crafted Transport Neutral...
CVE-2026-103680 Tnef: heap buffer overflow in find_free_number() via numbered-backup suffix generation
A flaw was found in tnef. A heap-based buffer overflow can occur in the findfreenumber function when generating numbered backup suffixes for duplicate filenames. When numbered backups are enabled and file overwriting is disabled, an attacker can supply a specially crafted Transport Neutral...
CVE-2026-103680 Tnef: heap buffer overflow in find_free_number() via numbered-backup suffix generation
A flaw was found in tnef. A heap-based buffer overflow can occur in the findfreenumber function when generating numbered backup suffixes for duplicate filenames. When numbered backups are enabled and file overwriting is disabled, an attacker can supply a specially crafted Transport Neutral...
kernel: netfilter: flowtable: publish GC-visible tuple last
A flaw was found in the netfilter flowtable component of the Linux kernel. This vulnerability occurs due to a timing issue where the system's garbage collection can free a network flow while it is still being set up. This can lead to a 'use-after-free' condition, where the system attempts to acce...
kernel: tipc: fix double-free in tipc_buf_append()
A flaw was found in the Linux kernel's Transparent Inter-Process Communication TIPC module. This vulnerability, a double-free, occurs when the tipcbufappend function incorrectly handles memory after a socket buffer skb reallocation. An attacker could potentially exploit this to cause system...
Vulnerability hidden in Apple CoreGraphics
Apple has identified a vulnerability in CoreGraphics on iOS, iPadOS, and macOS. This vulnerability involves an out-of-bounds write operation within the CoreGraphics component. An attacker can exploit this vulnerability by processing specially crafted files, which may lead to the execution of...
gvfs: SFTP: heap-based buffer overflow in read_reply()
A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause readreply to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing...
CLEANSTART-2024-PH67520 Use after free in DevTools in Google Chrome prior to 92
Security vulnerability affects the chromium package. Use after free in DevTools in Google Chrome prior to 92...
CLEANSTART-2025-LU26051 Exim supports the use of multiple "-p" command line arguments which are malloc()'ed and never free()'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution
Security vulnerability affects the exim package. Exim supports the use of multiple "-p" command line arguments which are malloc'ed and never free'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution...