GHSA-8J44-735H-W4W2 node-tesseract-ocr is vulnerable to OS Command Injection through unsanitized recognize() function parameter

node-tesseract-ocr is an npm package that provides a Node.js wrapper for Tesseract OCR. In all versions through 2.2.1, the recognize function in src/index.js is vulnerable to OS Command Injection. The file path parameter is concatenated into a shell command string and passed to childprocess.exec...

thumbler allows OS Command Injection

thumbler through 1.1.2 allows OS command injection via the input, output, time, or size parameter in the thumbnail function because user input is concatenated into a shell command string passed to childprocess.exec without proper sanitization or escaping...

Allocation of Resources Without Limits or Throttling

Overview liquidjs is an A simple, expressive, safe and Shopify compatible template engine in pure JavaScript. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through improper validation of range values in the use function. An attacker can...

EUVD-2026-15754

Requests has Insecure Temp File Reuse in its extractzippedpaths utility function...

SUSE CVE-2026-23353

In the Linux kernel, the following vulnerability has been resolved: ice: fix crash in ethtool offline loopback test Since the conversion of ice to page pool, the ethtool loopback test crashes: BUG: kernel NULL pointer dereference, address: 000000000000000c PF: supervisor write access in kernel mo...

CVE-2026-23320

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-23303

In the Linux kernel, the following vulnerability has been resolved: smb: client: Don't log plaintext credentials in cifssetcifscreds When debug logging is enabled, cifssetcifscreds logs the key payload and exposes the plaintext username and password. Remove the debug log to avoid exposing...

UBUNTU-CVE-2026-23386

In the Linux kernel, the following vulnerability has been resolved: gve: fix incorrect buffer cleanup in gvetxcleanpendingpackets for QPL In DQ-QPL mode, gvetxcleanpendingpackets incorrectly uses the RDA buffer cleanup path. It iterates numbufs times and attempts to unmap entries in the dma array...

CVE-2026-23364

CVE-2026-23364 concerns the Linux kernel’s ksmbd path, where MAC comparisons were not performed in constant time. The underlying issue is a timing-attack-prone memcmp() usage; the recommended fix is to replace memcmp() with crypto_memneq() to ensure constant-time comparisons. The vulnerability is...

CVE-2026-23289

In the Linux kernel, the following vulnerability has been resolved: IB/mthca: Add missed mthcaunmapuserdb for mthcacreatesrq Fix a user triggerable leak on the system call failure path...

SUSE-SU-2026:1028-1 Security update for salt

This update for salt fixes the following issues: - Security issues fixed: CVE-2025-67724: Fixed missing validation of supplied reason phrase bsc1254903 CVE-2025-67725: Fixed DoS via malicious HTTP request bsc1254905 CVE-2025-67726: Fixed HTTP header parameter parsing algorithm bsc1254904...

SUSE CVE-2026-26209

cbor2 provides encoding and decoding for the Concise Binary Object Representation CBOR serialization format. Versions prior to 5.9.0 are vulnerable to a Denial of Service DoS attack caused by uncontrolled recursion when decoding deeply nested CBOR structures. This vulnerability affects both the...

CVE-2026-26833

thumbler through 1.1.2 allows OS command injection via the input, output, time, or size parameter in the thumbnail function because user input is concatenated into a shell command string passed to childprocess.exec without proper sanitization or escaping...

The vulnerability of the cifs_create() function in the fs/cifs/dir.c module of the Linux kernel file system allows a hacker to cause a service failure.

The vulnerability of the cifscreate function in the fs/cifs/dir.c module of the Linux kernel file system is related to improper memory release. Exploiting this vulnerability could allow an attacker to cause a service failure...

Linux Distros Unpatched Vulnerability : CVE-2026-23299

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: purge error queues in socket destructors When TX timestamping is enabled via SOTIMESTAMPING, SKBs may be queued into skerrorqueue and will stay there...

The vulnerability of the pci_get_other_drvdata() function in the drivers/net/ethernet/mellanox/mlx5/core/dev.c file of the Mellanox Ethernet network adapter support driver for Linux kernel allows a attacker to cause a service failure.

The vulnerability of the pcigetotherdrvdata function in the drivers/net/ethernet/mellanox/mlx5/core/dev.c file of the Mellanox Ethernet adapter support driver in the Linux operating system is related to an unauthorized call to a verification function. Exploiting this vulnerability could allow an...

The vulnerability of the erspan_fb_xmit() function in the net/ipv4/ip_gre.c module of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the erspanfbxmit function in the net/ipv4/ipgre.c module of the Linux kernel exposes confidential information. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-26832

node-tesseract-ocr is an npm package that provides a Node.js wrapper for Tesseract OCR. In all versions through 2.2.1, the recognize function in src/index.js is vulnerable to OS Command Injection. The file path parameter is concatenated into a shell command string and passed to childprocess.exec...

PT-2026-27801

Name of the Vulnerable Software and Affected Versions node-tesseract-ocr versions through 2.2.1 Description The recognize function in src/index.js is susceptible to OS Command Injection due to insufficient input sanitization. Specifically, the file path parameter is incorporated into a shell...

The vulnerability of the pass_establish() function in the drivers/infiniband/hw/cxgb4/cm.c module of the Linux kernel’s InfiniBand driver allows a attacker to cause a service failure.

The vulnerability of the passestablish function in the drivers/infiniband/hw/cxgb4/cm.c module of the Linux kernel driver for InfiniBand relates to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...