147417 matches found
Red Hat Enterprise Linux 安全漏洞
Red Hat Enterprise Linux is a Linux operating system for enterprise users developed by Red Hat, Inc. Red Hat Enterprise Linux 10 contains a security vulnerability. This vulnerability stems from improper handling of special XCOFF object files during linking. A local attacker can trick users into...
fprime 输入验证错误漏洞
fprime is an open-source flight software and embedded system framework developed by NASA. Versions of fprime prior to 4.2.0 contained a vulnerability related to input validation errors. This vulnerability stemmed from boundary-checking use of U32 addition, which allowed overflow bypasses, and the...
PT-2026-34506
Name of the Vulnerable Software and Affected Versions uutils coreutils affected versions not specified Description The id utility miscalculates the groups= section of its output by using a user's real GID instead of their effective GID to compute the group list. This creates a discrepancy compare...
PT-2026-35582
USN-8196-1 fixed vulnerabilities in strongSwan. This update provides the corresponding update to Ubuntu 26.04 LTS. Original advisory details: Haruto Kimura discovered that strongSwan incorrectly handled the supported versions extension in TLS. A remote attacker could possibly use this issue to...
PT-2026-34538
Name of the Vulnerable Software and Affected Versions Poetry versions prior to 2.3.4 Description The extractall function in src/poetry/utils/helpers.py extracts sdist tarballs without path traversal protection on Python versions where tarfile.data filter is unavailable. This occurs specifically o...
PT-2026-34441
Name of the Vulnerable Software and Affected Versions PRSD affected versions not specified Description A denial of service issue exists during PRSD detection. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability...
Amazon Corretto Java 8.x < 8.492.09.1 Multiple Vulnerabilities
The version of Amazon Corretto installed on the remote host is 8 prior to 8.492.09.1. It is, therefore, affected by multiple vulnerabilities as referenced in the corretto-8-2026-Apr-21 advisory. - An integer overflow in the ttvarloaditemvariationstore function of the Freetype library in versions...
Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-013841)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013841 advisory. In the Linux kernel, the following vulnerability has been resolved: net: rds: don't hold sock lock when cancelling work from rdstcpresetcallbacks syzbot is reporting...
Unity Linux 20.1070a Security Update: kernel (UTSA-2026-013442)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013442 advisory. An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. There is an out-of- bounds read and OOPS for SMB2WRITE, when there is a large...
Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-013702)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013702 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: refuse to create ea block when umounted The ea block expansion need to access sroot while i...
CVE-2026-40944 Oxia: TLS CA certificate chain validation fails with multi-certificate PEM bundles
Oxia is a metadata store and coordination system. Prior to 0.16.2, the trustedCertPool function in the TLS configuration only parses the first PEM block from CA certificate files. When a CA bundle contains multiple certificates e.g., intermediate + root CA, only the first certificate is loaded...
EUVD-2026-24498
Oxia is a metadata store and coordination system. Prior to 0.16.2, a race condition between session heartbeat processing and session closure can cause the server to panic with send on closed channel. The heartbeat method uses a blocking channel send while holding a mutex, and under specific timin...
CVE-2026-40943 Oxia: Server crash via race condition in session heartbeat handling
Oxia is a metadata store and coordination system. Prior to 0.16.2, a race condition between session heartbeat processing and session closure can cause the server to panic with send on closed channel. The heartbeat method uses a blocking channel send while holding a mutex, and under specific timin...
MINI-PXFV-V4HX-VJQJ
Bulletin has no description...
GHSA-J687-52P2-XCFF Astro: XSS in define:vars via incomplete </script> tag sanitization
Summary The defineScriptVars function in Astro's server-side rendering pipeline uses a case-sensitive regex //g to sanitize values injected into inline tags via the define:vars directive. HTML parsers close elements case-insensitively and also accept whitespace or / before the closing , allowing ...
CVE-2026-35238
...
CVE-2026-35236
...
CVE-2026-35232
CVE-2026-35232 affects Oracle Fusion Middleware’s Dynamic Monitoring Service (DMS) in versions 12.2.1.4.0 and 14.1.2.0.0. The vulnerability allows a low-privileged, network-accessible attacker (via HTTP) with user interaction to compromise the framework, potentially enabling unauthorized update/i...