401275 matches found
Malicious code in @greenlake/context-pane (npm)
@greenlake/context-pane is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 3.0.0, 1.0.0 has a postinstall script that runs node beacon.cjs on npm instal...
MAL-2026-18317 Malicious code in @greenlake/context-pane (npm)
@greenlake/context-pane is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 3.0.0, 1.0.0 has a postinstall script that runs node beacon.cjs on npm instal...
athena-starship (>=0.0.3, <=0.0.6), conflare (>=0.1.2, <=0.1.3) +11 more potentially affected by CVE-2026-115572 via pypdf (4.1.0)
pypdf PYPI version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - athena-starship =0.0.3, =0.1.2, =2.2.0, =3.3.0, =1.14.0, =0.1.4, =4.6.2, =0.1.0, =0.1.7 Source cves: CVE-2026-115572 Source advisory:...
Improper Handling of Highly Compressed Data (Data Amplification)
Overview github.com/labstack/echo/v5/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the Decompress middleware. An attacker can exhaust memory or CPU resources by sending a small,...
Improper Handling of Highly Compressed Data (Data Amplification)
Overview github.com/labstack/echo/v4/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the Decompress middleware. An attacker can exhaust memory or CPU resources by sending a small,...
atxm (0.3.0), cli-progress (1.9.0) +7 more potentially affected by CVE-2026-115778 via twisted (24.3.0)
twisted PYPI version 24.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - atxm 0.3.0 - cli-progress 1.9.0 - ctrader-open-api =0.9.2, =0.2.8, =4.3.0, =7.3.0, =1.2.5, =0.3.0b0, =2.3.0rc39, =2.3.0rc40 Source cves:...
CVE-2026-79978
The RTIO streaming completion callback adxl345processfifosamplescb in drivers/sensor/adi/adxl345/adxl345stream.c clamps the amount of FIFO data it will report readlen = MINfifobytes, bufavail to the space actually returned by rtiosqerxbuf, but then queues one 6-byte bus read per hardware FIFO ent...
CVE-2026-79978
The RTIO streaming completion callback adxl345processfifosamplescb in drivers/sensor/adi/adxl345/adxl345stream.c clamps the amount of FIFO data it will report readlen = MINfifobytes, bufavail to the space actually returned by rtiosqerxbuf, but then queues one 6-byte bus read per hardware FIFO ent...
CVE-2026-79978 Out-of-bounds write in the ADXL345 sensor driver RTIO streaming FIFO read path
The RTIO streaming completion callback adxl345processfifosamplescb in drivers/sensor/adi/adxl345/adxl345stream.c clamps the amount of FIFO data it will report readlen = MINfifobytes, bufavail to the space actually returned by rtiosqerxbuf, but then queues one 6-byte bus read per hardware FIFO ent...
CVE-2026-79978
The ADXL345 sensor driver in Zephyr contains an out-of-bounds write vulnerability in the adxl345_process_fifo_samples_cb() callback within drivers/sensor/adi/adxl345/adxl345_stream.c. The root cause is that the driver calculates buffer offsets based on hardware-reported FIFO entries rather than t...
EUVD-2026-109141
The RTIO streaming completion callback adxl345processfifosamplescb in drivers/sensor/adi/adxl345/adxl345stream.c clamps the amount of FIFO data it will report readlen = MINfifobytes, bufavail to the space actually returned by rtiosqerxbuf, but then queues one 6-byte bus read per hardware FIFO ent...
CVE-2026-79978
The RTIO streaming completion callback adxl345processfifosamplescb in drivers/sensor/adi/adxl345/adxl345stream.c clamps the amount of FIFO data it will report readlen = MINfifobytes, bufavail to the space actually returned by rtiosqerxbuf, but then queues one 6-byte bus read per hardware FIFO ent...
CVE-2026-79978 Out-of-bounds write in the ADXL345 sensor driver RTIO streaming FIFO read path
The RTIO streaming completion callback adxl345processfifosamplescb in drivers/sensor/adi/adxl345/adxl345stream.c clamps the amount of FIFO data it will report readlen = MINfifobytes, bufavail to the space actually returned by rtiosqerxbuf, but then queues one 6-byte bus read per hardware FIFO ent...
CVE-2026-79977
The WireGuard VPN service in the Zephyr operating system (specifically in subsys/net/lib/wireguard/wg.c) is vulnerable to an off-path tunnel hijack. The handle_transport_data() function incorrectly updates the peer->endpoint by copying the source address of an unauthenticated transport-data me...
CVE-2026-79977 WireGuard peer endpoint learned from unauthenticated transport-data messages allows off-path tunnel hijack in Zephyr
The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate. In handletransportdata, when the 32-bit receiver index of an incoming transport-data message matched no session, the code both scheduled a new handshake and copied the...
GHSA-R3G7-R4HR-M258 obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes
Summary createentity, linkentities, renameentity, unlinkentities and deleteentity regenerate a memory note's body from SQLite at the computed memory//.md path. When a note already existed at that path and was not owned by the entity being written a hand-authored note, or an orphan left by a...
Security Bulletin: IBM Guardium Data Protection is affected by a security vulnerability (CVE-2025-5278)
Summary IBM Guardium Data Protection has addressed this vulnerability in an update. Vulnerability Details CVEID:CVE-2025-5278 DESCRIPTION: A flaw was found in GNU Coreutils. The sort utility's begfield function is vulnerable to a heap buffer under-read. The program may access memory outside the...
Exploit for Improperly Controlled Sequential Memory Allocation in Php
php2shell-sapi-differential Differential research on CVE-2026...
EUVD-2026-97736
obsidian-tc: Default folder ACL is fail-open; .obsidian plugin secrets are readable by default...
CVE-2026-55889
A flaw was found in xdg-desktop-portal. The service uses a predictable pseudorandom number generator PRNG to generate authorization tokens that manage access to shared system resources. By requesting enough tokens to determine the internal state of the generator, a malicious sandboxed application...