8906 matches found
CVE-2026-59874 node-tar: Negative tar entry size causes infinite loop in archive replace
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18...
CVE-2026-59873
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk spac...
MINI-67Q5-C6XV-MXF4
Bulletin has no description...
MINI-F3R3-3P4F-2RFH
Bulletin has no description...
MINI-VCHR-VCFJ-27QV
Bulletin has no description...
DEBIAN-CVE-2026-14454
Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed. Imager mishandled large EXIF IFD entry count values, treating them as negative numbers. This could lead to an attempt to allocate a block nearly the size of the address space, which fails and kills the process. ...
WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.2 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by ParkHyunWoo in WordPress Plugin CF7 Views Complete Entry Management for Contact Form 7 versions = 3.2.2...
CVE-2026-14454
Imager for Perl prior to 1.033 mishandles unsigned EXIF IFD entry counts by treating them as signed, potentially causing an attempt to allocate a block near the address space and terminating a worker process. This can be triggered by crafting an image with crafted EXIF data. The published fix is ...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: ima: Handle error code returned by imafilterrulematch In imamatchRules, if imafilterruleMatch returns -ENOENT due to the rule being NULL, the function incorrectly skips the if !rc check and sets result = true. The LSM rule is...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerabilities have been resolved: kexec: deriving the entry from the purgatory symbol The kexecloadpurgatory function derives image-start by locating eentry within an SHFEXECINSTR section. If the purgatory object contains multiple executable sections with...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerabilities have been resolved: KVM: Do not corrupt the irqfd routing entry when deassigning an irqfd When deassigning a KVMIRQFD, do not corrupt the irqfd’s copy of the IRQ routing entry. Doing so would break the kvmarchirqbypassdelproducer function on x86...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: macvlan: fixed a possible Use-after-Allocation UAF in macvlanforwardsource. Added RCU protection for the vlan field of struct macvlansourceentry. Whenever macvlanhashdelsource is called, we must clear the entry-vlan pointer befor...
MINI-XF64-P5RG-W68P
Bulletin has no description...
MINI-J5PQ-C8H4-8GQW
Bulletin has no description...
MINI-V7W5-5J5X-P9V5
Bulletin has no description...
CVE-2026-57244 Foxit PDF Editor/Reader Form Control Use-After-Free Vulnerability
After JavaScript resetting the form, the synchronization process lacks re-entry protection and object lifecycle verification, resulting in the failure of the control pointer during the traversal process. After the pointer fails, it still continues to dereference, causing the application to crash...
CVE-2026-59194
A flaw was found in pnpm, a package manager. A remote attacker could exploit this vulnerability by providing a specially crafted patch entry. This crafted entry could resolve outside the configured patches directory, allowing for the deletion of an arbitrary file when pnpm patch-remove is execute...
CGA-VFVF-J9MM-38JF
Bulletin has no description...