CRLF Injection

Overview Affected versions of this package are vulnerable to CRLF Injection via the BytesGenerator class in the email module due to unquoted newlines when serializing an email message. An attacker could perform email spoofing, data exfiltration, or content manipulation by injecting malicious CRLF...

Uncontrolled Recursion

Overview protobuf is a Google’s data interchange format Affected versions of this package are vulnerable to Uncontrolled Recursion in the ParseDict function, when handling deeply nested google.protobuf.Any messages. An attacker can bypass maxrecursiondepth to exhaust the recursion stack and trigg...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion in the ParseDict function, when handling deeply nested google.protobuf.Any messages. An attacker can bypass maxrecursiondepth to exhaust the recursion stack and trigger a RecursionError. Remediation Upgrade protob...

Allocation of Resources Without Limits or Throttling

Overview org.webjars.npm:seroval is a Stringify JS values Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the encoded array lengths serialization process. An attacker can cause excessive processing time by overriding encoded array lengt...

Improper Verification of Cryptographic Signature

Overview org.webjars.npm:sm-crypto is a sm-crypto Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the SM2 signature verification process. An attacker can bypass signature validation by forging signatures for arbitrary public keys. Remediatio...

Insufficient Verification of Data Authenticity

Overview org.webjars.npm:sm-crypto is a sm-crypto Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the SM2 decryption logic. An attacker can recover sensitive private key material by repeatedly interacting with the decryption interface...

CRLF Injection

Overview Affected versions of this package are vulnerable to CRLF Injection via the http.cookies.Morsel field. An attacker can manipulate HTTP responses by injecting arbitrary headers through user-controlled cookie values or parameters. Remediation A fix was pushed into the master branch but not...

HTTP Response Splitting

Overview Affected versions of this package are vulnerable to HTTP Response Splitting via the wsgiref.headers.Headers. An attacker can manipulate HTTP responses by injecting arbitrary headers through user-controlled input containing newline characters. Remediation A fix was pushed into the master...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the totalPCMFrameCount field from FLAC metadata before buffer size calculation. An attacker can cause a program crash or resource exhaustion by providing a specially crafted file. Remediation A fix was...

Release of Invalid Pointer or Reference

Overview Affected versions of this package are vulnerable to Release of Invalid Pointer or Reference via the BilateralBlurImage function. An attacker can cause application instability or crashes by providing a specially crafted image that triggers the release of an invalid pointer when memory...

MiracleLinux 7 : kernel-3.10.0-1160.80.1.el7 (AXSA:2022-4024:16)

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2022-4024:16 advisory. a use-after-free in clsroute filter implementation may lead to privilege escalation CVE-2022-2588 RetBleed Arbitrary Speculative Code Execution with...

MiracleLinux 4 : gcc-4.4.7-18.2.0.1.AXS4 (AXBA:2018-3035:03)

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXBA:2018-3035:03 advisory. - Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the LoadFontData function. An attacker can cause memory corruption or unexpected behavior by providing crafted input that triggers an integer overflow during font data processing. This is only...

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the GenImageFontAtlas function. An attacker can execute arbitrary code or cause a denial of service by providing specially crafted input that triggers a heap-based buffer overflow during local execution...

openSUSE 16 Security Update : erlang (openSUSE-SU-2026:20043-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20043-1 advisory. Update the ssh component to the latest in the maint-27 branch. Security issues fixed: - CVE-2025-48040: ssh: overly tolerant handling of data...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the validate input size of hashtags in HTTP requests. An attacker can exhaust CPU resources by submitting a single HTTP request containing a post with thousands of space-separated...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the validate input size of hashtags in HTTP requests. An attacker can exhaust CPU resources by submitting a single HTTP request containing a post with thousands of space-separated...

MiracleLinux 7 : linux-firmware-20170606-57.gitc990aae.el7 (AXSA:2018-2499:01)

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2018-2499:01 advisory. An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions a commonly used...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-004786)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004786 advisory. The Linux kernel allows userspace processes to enable mitigations by calling prctl with PRSETSPECULATIONCTRL which disables the speculation feature as well as by usi...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-004365)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004365 advisory. The Linux kernel allows userspace processes to enable mitigations by calling prctl with PRSETSPECULATIONCTRL which disables the speculation feature as well as by usi...