44685 matches found
OPENSUSE-SU-2026:10281-1 mchange-commons-0.4.0-1.1 on GA media
These are all security issues fixed in the mchange-commons-0.4.0-1.1 package on the GA media of openSUSE Tumbleweed...
Tenda TX3 Router SetIpMacBind Data Compromise
The vulnerability of the goform/SetIpMacBind function in the Tenda TX3 router microprogramming system lies in the fact that the operation’s output goes beyond the buffer in memory. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrity, and accessibili...
Tenda TX9 Pro Router Sub_42D03C Function
The vulnerability of the sub42D03C /goform/SetStaticRouteCfg function in the Tenda TX9 Pro router software is related to the operation of writing data outside the buffer in memory when processing the deviceList parameter. Exploiting this vulnerability allows an attacker to compromise the...
Linux kernel mac_hid_toggle_emumouse Heap Buffer Overflow
The vulnerability of the machidtoggleemumouse function in the drivers/macintosh/machid.c file of the Linux kernel is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility o...
Linux Ethernet Network Adapter Driver Buffer Overflow
The vulnerability of the enacomcompstatustoerrno function in the drivers/net/ethernet/amazon/ena/enacom.c file of the Ethernet network adapter driver for the Linux operating system is related to integer overflow or cyclic shift vulnerabilities. Exploiting this vulnerability could allow an attacke...
GHSA-77HF-7FQF-F227 OpenClaw skills-install-download: tar.bz2 extraction bypassed archive safety parity checks (local DoS)
Summary The tar.bz2 installer path in src/agents/skills-install-download.ts used shell tar preflight/extract logic that did not share the same hardening guarantees as the centralized archive extractor. This allowed crafted .tar.bz2 archives to bypass special-entry blocking and extracted-size...
GHSA-VPQ2-C234-7XJ6 @tootallnate/once vulnerable to Incorrect Control Flow Scoping
Versions of the package @tootallnate/once before 3.0.1 are vulnerable to Incorrect Control Flow Scoping in promise resolving when AbortSignal option is used. The Promise remains in a permanently pending state after the signal is aborted, causing any await or .then usage to hang indefinitely. This...
EUVD-2026-9278
Versions of the package @tootallnate/once before 3.0.1 are vulnerable to Incorrect Control Flow Scoping in promise resolving when AbortSignal option is used. The Promise remains in a permanently pending state after the signal is aborted, causing any await or .then usage to hang indefinitely. This...
CVE-2026-3449
Versions of the package @tootallnate/once before 3.0.1 are vulnerable to Incorrect Control Flow Scoping in promise resolving when AbortSignal option is used. The Promise remains in a permanently pending state after the signal is aborted, causing any await or .then usage to hang indefinitely. This...
CVE-2026-3449: Incorrect Control Flow Scoping
Versions of the package @tootallnate/once before 3.0.1 are vulnerable to Incorrect Control Flow Scoping in promise resolving when AbortSignal option is used. The Promise remains in a permanently pending state after the signal is aborted, causing any await or .then usage to hang indefinitely. This...
PT-2026-25437
Summary The tar.bz2 installer path in src/agents/skills-install-download.ts used shell tar preflight/extract logic that did not share the same hardening guarantees as the centralized archive extractor. This allowed crafted .tar.bz2 archives to bypass special-entry blocking and extracted-size...
@tootallnate/once security vulnerability
@tootallnate/once is a JavaScript code library developed by Nathan Rajlich personally. Versions of @tootallnate/once prior to version 3.0.1 contained security vulnerabilities. These vulnerabilities stemmed from errors in the control flow scope when using the AbortSignal option. After the signal i...
malcontent: Error-path cleanup gap can leak scanners and fds and degrade availability
Several extraction and scanning code paths registered late defers which could leak resources and exhaust system resources. This report is an aggregate of these individual reports for the affected code: Advisory | Affected File -- | -- GHSA-jjgh-mc5q-gch7 | pkg/action/scan.go GHSA-mwmf-fxh2-w4x7 |...
CVE-2026-2584
A critical SQL Injection SQLi vulnerability has been identified in the authentication module of the system. An unauthenticated, remote attacker AV:N/PR:N can exploit this flaw by sending specially crafted SQL queries through the login interface. Due to low attack complexity AC:L and the absence o...
PT-2026-25126
Summary @openclaw/voice-call and the bundled copy shipped in openclaw accepted media-stream WebSocket upgrades before stream validation. In reachable deployments, unauthenticated pre-start sockets could be held open and increase resource pressure. Affected Packages / Versions - openclaw npm:...
ath9k_wmi_ctrl_rx Heap Buffer Overflow DoS
The vulnerability of the ath9kwmictrlrx function in the drivers/net/wireless/ath/ath9k/wmi.c module of the Atheros/Qualcomm wireless communication adapter driver for the Linux operating system is related to the access to an uninitialized pointer. Exploiting this vulnerability could allow an...
fs/nfsd/nfs4callback.c NFS Data Compromise
The vulnerability of the setupcallbackclient function in the fs/nfsd/nfs4callback.c module, which supports the Network File System in Linux kernels, is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...
OPENSUSE-SU-2026:10277-1 python311-pypdf-6.7.5-1.1 on GA media
These are all security issues fixed in the python311-pypdf-6.7.5-1.1 package on the GA media of openSUSE Tumbleweed...
Linux kernel trace_pid_write buffer overflow DoS
The vulnerability of the tracepidwrite function in the kernel/trace/trace.c module, which supports Linux operating system tracing, is related to the repeated release of previously released memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity,...
Linux TCP Disconnect Use-After-Free
The vulnerability of the tcpdisconnect function in the net/ipv4/tcp.c module of the Linux kernel’s IPv4 protocol implementation is related to improper release of resources. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the...