147508 matches found
The vulnerability of the fpu_clone() function in Linux kernel allows a hacker to trigger a service failure.
The vulnerability of the fpuclone function in Linux operating systems is related to incorrect resource locking. Exploiting this vulnerability can allow an attacker to cause a service failure...
The vulnerability of the mt7915_put_hif2() function in the drivers/net/wireless/mediatek/mt76/mt7915/pci.c file of the wireless adapter driver for Mediatek’s Linux operating system allows a hacker to cause a service failure.
The vulnerability of the mt7915puthif2 function in the driver/net/wireless/mediatek/mt76/mt7915/pci.c file of the Mediatek wireless adapter driver for the Linux operating system is related to the failure to release resources after their useful life has ended. Exploiting this vulnerability could...
The vulnerability of the dwc3_qcom_probe() function in the drivers/usb/dwc3/dwc3-qcom.c driver code of the DesignWare-based USB3 controller driver for the Linux operating system allows a hacker to cause a service failure.
The vulnerability of the dwc3qcomprobe function in the drivers/usb/dwc3/dwc3-qcom.c file of the DesignWare-based USB3 controller driver in the Linux operating system is related to improper memory release. Exploiting this vulnerability could allow an attacker to cause a service failure...
Prosody XMPP server advisory 2026-04-29
The Prosody team reports: Traffic patterns were discovered which can cause Prosody to consume excessive amounts of memory with much smaller amounts of incoming traffic. This traffic can be sent by unauthenticated connections. It was discovered that modproxy65’s access control was broken and...
PT-2026-36023
A weakness has been identified in BurtTheCoder mcp-dnstwist up to 1.0.4. Affected by this vulnerability is the function fuzz domain of the file src/index.ts of the component MCP Interface. Executing a manipulation of the argument Request can lead to os command injection. The attack may be launche...
Jenkins plugins Multiple Vulnerabilities (2026-04-29)
According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - High HTML Publisher Plugin 427 and earlier does not escape job name and URL in the legacy wrapper file. This results in a stored cross-site...
Linux Distros Unpatched Vulnerability : CVE-2026-7350
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in WebMIDI in Google Chrome prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer process to potentially perform a...
Linux Distros Unpatched Vulnerability : CVE-2026-1660
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.3 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that under certain...
Linux Distros Unpatched Vulnerability : CVE-2026-31650
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mmc: vub300: fix use-after-free on disconnect The vub300 driver maintains an explicit reference count for the controller and its driver data and the last...
PT-2026-36019
Name of the Vulnerable Software and Affected Versions Algovate xhs-mcp version 0.8.11 Description An issue exists in the MCP Interface component within the xhs publish content function of the src/server/mcp.server.ts file. A remote attacker can perform server-side request forgery SSRF—a flaw that...
PT-2026-36005
A security flaw has been discovered in geldata gel-mcp 0.1.0. This impacts the function list rules/fetch rule of the file src/gel mcp/server.py. The manipulation of the argument rule name results in path traversal. The attack may be performed from remote. The exploit has been released to the publ...
Cockpit 代码问题漏洞
Cockpit is an interactive server management interface developed by Cockpit OpenSource. Versions of Cockpit 2.13.5 and earlier had a code vulnerability caused by improper configuration of the isFileTypeAllowed function in the Bucket component. This vulnerability could lead to arbitrary file renami...
PT-2026-35897
Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description When using the Certificate Status Request TLS extension, commonly known as OCSP stapling, to verify server certificate validity, the software fails to detect OCSP problems and incorrectly treats...
The vulnerability of the DCB_ATTR_BCN() function in Linux operating system kernels allows a attacker to compromise the accessibility of protected information.
The vulnerability of the DCBATTRBCN function in Linux operating systems is related to reading data beyond the allowed range of memory. Exploiting this vulnerability could allow an attacker to compromise the accessibility of protected information...
RHEL 10 : yggdrasil (RHSA-2026:11413)
The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:11413 advisory. yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child worker...
Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 : Vim vulnerabilities (USN-8213-1)
The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8213-1 advisory. Micha Majchrowicz discovered that Vim's zip plugin could overwrite arbitrary files. A...
CVE-2026-40560
Starman versions before 0.4018 for Perl allows HTTP Request Smuggling via Improper Header Precedence. Starman incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence. An...
CVE-2026-7358
Use after free in Animation in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...
CoreDNS has TSIG authentication bypass on gRPC and QUIC transports
Summary The gRPC, QUIC, DoH, and DoH3 transports in CoreDNS incorrectly handle TSIG authentication. For gRPC and QUIC, CoreDNS checks whether the TSIG key name exists in the config, but does not actually verify the TSIG HMAC. If the key name matches, tsigStatus remains nil and the tsig plugin...
