@tootallnate/once 安全漏洞

@tootallnate/once is a JavaScript code library developed by Nathan Rajlich personally. Versions of @tootallnate/once prior to version 3.0.1 contained security vulnerabilities. These vulnerabilities stemmed from errors in the control flow scope when using the AbortSignal option. After the signal i...

UBUNTU-CVE-2025-10990

A flaw was found in REXML. A remote attacker could exploit inefficient regular expression regex parsing when processing hex numeric character references &x...; in XML documents. This could lead to a Regular Expression Denial of Service ReDoS, impacting the availability of the affected component...

The vulnerability of the niu_try_msix() function in the drivers/net/ethernet/sun/niu.c module of the Linux kernel’s Ethernet network adapter support driver allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the niutrymsix function in the drivers/net/ethernet/sun/niu.c module of the Linux kernel’s Ethernet adapter support driver is related to the improper disabling or release of resources. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

PT-2026-22116

Name of the Vulnerable Software and Affected Versions Fleet versions prior to 4.80.1 Description Fleet’s certificate template deletion API had a broken authorization check. This allowed a team administrator to delete certificate templates belonging to other teams within the same Fleet instance. T...

The vulnerability of the link_status_user_format() function in the drivers/net/ethernet/marvell/octeontx2/af/cgx.c file of the Ethernet network adapter driver for the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the linkstatususerformat function in the drivers/net/ethernet/marvell/octeontx2/af/cgx.c file of the Ethernet network adapter driver for the Linux operating system is related to improper cleaning or release of resources. Exploiting this vulnerability could allow an attacker t...

GHSA-76RV-2R9V-C5M6 zae-limiter: DynamoDB hot partition throttling enables per-entity Denial of Service

Summary All rate limit buckets for a single entity share the same DynamoDB partition key namespace/ENTITYid. A high-traffic entity can exceed DynamoDB's per-partition throughput limits 1,000 WCU/sec, causing throttling that degrades service for that entity — and potentially co-located entities in...

CVE-2026-27482 Ray: Dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion)

Ray is an AI compute engine. In versions 2.53.0 and below, thedashboard HTTP server blocks browser-origin POST/PUT but does not cover DELETE, and key DELETE endpoints are unauthenticated by default. If the dashboard/agent is reachable e.g., --dashboard-host=0.0.0.0, a web page via DNS rebinding o...

CVE-2026-23596

A vulnerability in the management API of the affected product could allow an unauthenticated remote attacker to trigger service restarts. Successful exploitation could allow an attacker to disrupt services and negatively impact system availability...

CVE-2026-23596

A vulnerability in the management API of the affected product could allow an unauthenticated remote attacker to trigger service restarts. Successful exploitation could allow an attacker to disrupt services and negatively impact system availability...

CVE-2026-23596

CVE-2026-23596 describes an unauthenticated remote vulnerability in the management API that can trigger service restarts, potentially disrupting services and reducing system availability. The available records indicate an impact on availability (CVSSv3.1: AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with...

CVE-2026-23596 Unauthenticated Improper Access Control in management API allows unauthorized service disruption

A vulnerability in the management API of the affected product could allow an unauthenticated remote attacker to trigger service restarts. Successful exploitation could allow an attacker to disrupt services and negatively impact system availability...

CVE-2025-31655

Incorrect default permissions for some IntelR Battery Life Diagnostic Tool within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may...

github.com/sirupsen/logrus: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload

A denial-of-service vulnerability in github.com/sirupsen/logrus occurs when Entry.Writer processes a single-line payload larger than 64KB with no newline characters. Due to a limitation in Go’s internal bufio.Scanner, the read operation fails with a “token too long” error, causing the underlying...

DoS (Denial of Service) in Confluence Data Center and Server

This High severity DoS Denial of Service vulnerability known as CVE-2020-28469 was introduced in versions 7.19 of Confluence Data Center and Server. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an...

CVE-2024-36320

CVE-2024-36320 describes an integer overflow in the Windows/AMD graphics driver component atihdwt6.sys that can allow a local attacker to perform out-of-bounds reads/writes, leading to potential loss of confidentiality, integrity, and availability. Connected sources corroborate a local-privilege-...

CVE-2026-0485

SAP BusinessObjects BI Platform allows an unauthenticated attacker to send specially crafted requests that could cause the Content Management Server CMS to crash and automatically restart. By repeatedly submitting these requests, the attacker could induce a persistent service disruption, renderin...

CVE-2026-0490

SAP BusinessObjects BI Platform allows an unauthenticated attacker to craft a specific network request to the trusted endpoint that breaks the authentication, which prevents the legitimate users from accessing the platform. As a result, it has a high impact on the availability but no impact on th...

CVE-2026-0509

SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated, low-privileged user to perform background Remote Function Calls without the required SRFC authorization in certain cases. This can result in a high impact on integrity and availability, and no impact on the...

PT-2026-7586

A Time-of-check time-of-use TOCTOU race condition in the AMD Secure Processor ASP could allow an attacker to corrupt memory resulting in loss of integrity, confidentiality, or availability...

Huawei HarmonyOS Media Subsystem Out-of-Bounds Read Vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. An out-of-bounds read vulnerability exists in the Huawei HarmonyOS media subsystem, which can be exploited by attackers to cause confidentiality and...