ai-24sea (>=0.1.0, <=1.0.0), cogflow (>=1.12.0, <=3.0.0b14) +4 more potentially affected by CVE-2025-15036 via mlflow (2.22.0)

mlflow PYPI version 2.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - ai-24sea =0.1.0, =1.12.0, =1.4.5, =0.1.6, =1.0.2, =1.1.0rc4 Source cves: CVE-2025-15036 Source advisory: OSV:GHSA-VHCX-3PQ2-4FVC...

CVE-2026-33977

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, a malicious RDP server can crash the FreeRDP client by sending audio data in IMA ADPCM format with an invalid initial step index value = 89. The unvalidated step index is read directly from the network and...

ai-24sea (>=0.1.0, <=1.0.0), cogflow (>=1.12.0, <=3.0.0b14) +4 more potentially affected by CVE-2025-15381 via mlflow (2.22.0)

mlflow PYPI version 2.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - ai-24sea =0.1.0, =1.12.0, =1.4.5, =0.1.6, =1.0.2, =1.1.0rc4 Source cves: CVE-2025-15381 Source advisory: OSV:GHSA-G6PG-52VF-843H...

CVE-2026-22790

EVerest is an EV charging software stack. Prior to version 2026.02.0, HomeplugMessage::setuppayload trusts len after an assert; in release builds the check is removed, so oversized SLAC payloads are memcpy'd into a 1497-byte stack buffer, corrupting the stack and enabling remote code execution fr...

EUVD-2026-16197

EVerest is an EV charging software stack. Prior to version 2026.02.0, HomeplugMessage::setuppayload trusts len after an assert; in release builds the check is removed, so oversized SLAC payloads are memcpy'd into a 1497-byte stack buffer, corrupting the stack and enabling remote code execution fr...

Security update for systemd

This update for systemd fixes the following issues: CVE-2026-4105: privilege escalation due to improper access control in RegisterMachine D-Bus method bsc1259650. CVE-2026-29111: local unprivileged user can trigger an assert in systemd bsc1259418. udev: check for invalid chars in various fields...

systemd: Local unprivileged user can trigger an assert

...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: glibc (UTSA-2026-006302)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006302 advisory. When the assert function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size...

assert-files (>=0.1.0, <=0.1.3), vpplib (0.0.4) +1 more potentially affected by CVE-2026-33699 via pypdf (3.16.4)

pypdf PYPI version 3.16.4 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - assert-files =0.1.0, =0.61.0, =0.65.0 Source cves: CVE-2026-33699 Source advisory: OSV:GHSA-87MJ-5GGW-8QC3...

MongoDB DoS

The vulnerability of the MongoDB database management system is related to the lack of use of the assert function. Exploiting this vulnerability can allow a malicious actor to cause service failures...

Avahi Service Detection Heap Buffer Overflow DoS

The vulnerability of the Avahi service detection system in local networks is related to the lack of use of the assert function. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

Avahi Service Detection Heap Buffer Overflow DoS

The vulnerability of the Avahi service detection system in local networks is related to the lack of use of the assert function. Exploiting this vulnerability can allow a perpetrator to cause a service failure...

Node.js url module DoS

The vulnerability of the url module in the Node.js software platform is related to the lack of use of the assert function. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

Avahi Service Detection Heap Buffer Overflow DoS

The vulnerability of the Avahi service detection system in local networks is related to the lack of use of the assert function. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

Linux Distros Unpatched Vulnerability : CVE-2026-29111

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - systemd, a system and service manager, as PID 1 hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v2...

DEBIAN-CVE-2026-29111

systemd, a system and service manager, as PID 1 hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this i...

CVE-2026-29111 systemd: Local unprivileged user can trigger an assert

systemd, a system and service manager, as PID 1 hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this i...

CVE-2026-29111

CVE-2026-29111: systemd local unprivileged user can trigger an assert via an unprivileged IPC API call with spurious data. The issue affects versions from v239 onward; older than v239 are not affected, while v249 and older exhibited stack overwriting, attacker-controlled content. Patches exist in...

CVE-2026-29111 systemd: Local unprivileged user can trigger an assert

systemd, a system and service manager, as PID 1 hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this i...

UBUNTU-CVE-2026-23555

Any guest issuing a Xenstore command accessing a node using the illegal node path "/local/domain/", will crash xenstored due to a clobbered error indicator in xenstored when verifying the node path. Note that the crash is forced via a failing assert statement in xenstored. In case xenstored is...