731 matches found
Linux Kernel Security Vulnerabilities
The Linux kernel version 6.13 contains a security vulnerability. This vulnerability arises from the fact that the UDP socket is disconnected from the quadruplet hash table, but the hash count remains retained. As a result, data packets are still processed through quadruplet lookups, which may lea...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Rejecting empty multisync extensions prevents infinite loops. The v3dgetextensions function iterates over a singly-linked list of ioctl extensions provided by the user space. This list has no bounds on its length. A loca...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmidi: fix MIDI Streaming descriptor lengths While the MIDI jacks are correctly configured, and the MIDIStreaming endpoint descriptors contain the correct information, the values of bNumEmbMIDIJack and bLength are se...
CVE-2026-97873
A flaw was found in Bouncy Castle. In its legacy password-based encryption implementations, iteration counts parsed from untrusted cryptographic inputs are processed without enforcing an upper limit. A remote attacker could exploit this vulnerability by supplying crafted parameters with an...
CVE-2026-108749
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
EUVD-2026-96914
docling-serve 1.14.0 through 1.36.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access /v1/memory/stats and /v1/memory/counts because they omit the requireauth dependency. Attackers can bypass the configured DOCLINGSERVEAPIKEY to read process and cgrou...
CVE-2026-108749 docling-serve 1.14.0 through 1.36.0 Missing Authentication via Memory Management Endpoints
docling-serve 1.14.0 through 1.36.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access /v1/memory/stats and /v1/memory/counts because they omit the requireauth dependency. Attackers can bypass the configured DOCLINGSERVEAPIKEY to read process and cgrou...
CVE-2026-108749
A missing authentication vulnerability in docling-serve versions 1.14.0 through 1.36.0 allows unauthenticated remote attackers to access the /v1/memory/stats and /v1/memory/counts endpoints. The root cause is the omission of the require_auth dependency, enabling attackers to bypass the DOCLING_SE...
CVE-2026-108749
docling-serve 1.14.0 through 1.36.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access /v1/memory/stats and /v1/memory/counts because they omit the requireauth dependency. Attackers can bypass the configured DOCLINGSERVEAPIKEY to read process and cgrou...
CVE-2026-108749: Undefined Security Weakness
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
PT-2026-106759
Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.31.1 Description A flaw in the Penalty Handler component allows remote attackers to cause a denial of service. The issue resides in the get token bin counts and mask function within the vllm/model...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate HEVC active reference counts HEVC slice parameters are stateless V4L2 controls. However, the common validation process does not verify the active L0/L1 reference counts before driver-specific code uses...
CVE-2026-105205
SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish-mode readers to learn backlink block IDs and reference counts from password-protected and publish-disabled documents by querying a published document. Attackers can send POST requests to /api/block/getDocInfo...
CVE-2026-105205 SiYuan before 3.8.5 Information Disclosure via /api/block/getDocInfo and getDocsInfo
SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish-mode readers to learn backlink block IDs and reference counts from password-protected and publish-disabled documents by querying a published document. Attackers can send POST requests to /api/block/getDocInfo...
CVE-2026-105205
The SiYuan note-taking application (versions prior to 3.8.5 ) is vulnerable to an information disclosure vulnerability. An attacker can bypass the publish confidentiality boundary by sending POST requests to the /api/block/getDocInfo or getDocsInfo endpoints for a published document. This allows ...
CVE-2026-105205 SiYuan before 3.8.5 Information Disclosure via /api/block/getDocInfo and getDocsInfo
SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish-mode readers to learn backlink block IDs and reference counts from password-protected and publish-disabled documents by querying a published document. Attackers can send POST requests to /api/block/getDocInfo...
CVE-2026-105205: Exposure of Sensitive Information to an Unauthorized Actor
SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish-mode readers to learn backlink block IDs and reference counts from password-protected and publish-disabled documents by querying a published document. Attackers can send POST requests to /api/block/getDocInfo...
CVE-2026-101267
A missing permission check allows low-privileged users who have access to an event, but lack access to its orders, to extract specific information. This vulnerability leads to a revenue information leak , exposing details such as the total revenue and the number of attendees . No specific softwar...
CVE-2026-97576
In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate HEVC tile counts The stateless HEVC decoders read numtilecolumnsminus1 + 1 entries from columnwidthminus1 and numtilerowsminus1 + 1 from rowheightminus1 and use them as tile-loop bounds, but...