67 matches found
CVE-2026-96406 VIDEO class descriptor walk consumes device-controlled wTotalLength as its bound
A VideoStreaming interface reports the size of its whole class-specific descriptor block in the wTotalLength field of its input header. The USBX host recorded that figure and used it as the budget for walking the format, frame and frame-interval descriptors, without holding it against the...
CVE-2026-96406
The USBX host is vulnerable to an out-of-bounds read (CWE-125) during the processing of a VideoStreaming interface . The host incorrectly uses the device-controlled wTotalLength field from the input header as a budget for walking format, frame, and frame-interval descriptors without validating it...
CVE-2026-96406
A VideoStreaming interface reports the size of its whole class-specific descriptor block in the "wTotalLength" field of its input header. The USBX host recorded that figure and used it as the budget for walking the format, frame and frame-interval descriptors, without holding it against the...
CVE-2026-96406 VIDEO class descriptor walk consumes device-controlled wTotalLength as its bound
A VideoStreaming interface reports the size of its whole class-specific descriptor block in the wTotalLength field of its input header. The USBX host recorded that figure and used it as the budget for walking the format, frame and frame-interval descriptors, without holding it against the...
PT-2026-118371
A VideoStreaming interface reports the size of its whole class-specific descriptor block in the wTotalLength field of its input header. The USBX host recorded that figure and used it as the budget for walking the format, frame and frame-interval descriptors, without holding it against the...
EUVD-2026-87858
vm2: NodeVM custom resolution bypasses external path boundaries...
EUVD-2026-81600
vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package...
AlmaLinux 9.6 [TuxCare] Security Update: flatpak / flatpak-devel / flatpak-libs / flatpak-selinux / etc (ALMALINUX9.6:CLSA-2026:1781603962)
The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781603962 advisory. - Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expo...
UBUNTU-CVE-2026-100395
lxc-copy host-context hostname update follows symlink...
CVE-2026-100395
lxc-copy host-context hostname update follows symlink...
CVE-2026-100721 vm2 before 3.12.2 Authorization Bypass via Custom Resolver
vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures require.external with a custom resolver and context: 'host', LegacyResolver.customResolve in lib/resolver-compat.js records the resolved module directory in this.externals as new...
PT-2026-108612
lxc-copy host-context hostname update follows symlink...
CVE-2026-96276 Flatpak: flatpak: arbitrary write in host context via flatpak build-init
If a malicious SDK container declares an extension point with a crafted directory path, and a developer runs flatpak build-init --writable-sdk --sdk-extension with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that...
CVE-2026-96276 Flatpak: flatpak: arbitrary write in host context via flatpak build-init
If a malicious SDK container declares an extension point with a crafted directory path, and a developer runs flatpak build-init --writable-sdk --sdk-extension with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that...
Malicious code in helpersutils-dev-tools (npm)
Source: amazon-inspector 85b7208dea3cf1742ac01332c17db9df968fd4a105fbccaf0b5388162b0f3673 The package presents itself as 'Development utility helpers' but its main module executes an IIFE at require-time that issues an Image request to http://5.189.173.113:8899/csp-edu with document.domain append...
Use of Incorrectly-Resolved Name or Reference
Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Use of Incorrectly-Resolved Name or Reference via the allowlist process. An attacker can execute unauthorized code in the host context by requiring a...
GHSA-6FVH-FGMG-3X7V Duplicate Advisory: vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-c48m-32m9-vx93. This link is maintained to preserve external references. Original Description vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses...
Duplicate Advisory: vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-c48m-32m9-vx93. This link is maintained to preserve external references. Original Description vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses...
CVE-2026-92951 vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver
vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requiring a colliding package name that contains an allowliste...
CVE-2026-92951
vm2 prior to version 3.11.7 is affected by an incorrect authorization flaw in its external package allowlist mechanism. The root cause is the use of non-exact substring matching instead of full package-name boundary validation, allowing an attacker to require a colliding package name that merely ...