4037 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-53392
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NFSv4/flexfiles: reject zero filehandle version count fflayoutalloclseg decodes the filehandle- version array count from the flexfiles layout body. The value is...
Linux Distros Unpatched Vulnerability : CVE-2026-63800
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pNFS: Fix use-after-free in pnfsupdatelayout When hitting the NFSLAYOUTRETURN branch in pnfsupdatelayout, the code calls pnfspreparetoretrylayoutgetlo. If it...
PT-2026-61116
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the pNFS component. When the NFS LAYOUT RETURN branch is triggered within the pnfs update layout function, the system calls pnfs prepare to retry...
Linux Distros Unpatched Vulnerability : CVE-2026-53399
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfsd: release layout stid on setlease failure nfs4allocstid publishes the new stid into cl-clstateids via idralloccyclic under cllock before returning to...
Shark vacuum flaw exposes cameras, home maps and Wi-Fi passwords
Shark’s cloud-connected robot vacuums are currently exposed by an unpatched AWS Amazon Web Services IoT Internet of Things policy flaw that could turn one compromised device into a remote-control skeleton key for many others in the same region, with access to cameras, maps, and Wi‑Fi passwords. A...
SUSE CVE-2026-42533
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable i...
CVE-2026-42533
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable i...
DRUPAL-CORE-2026-012
The Layout Builder module doesn't sufficiently sanitize block labels in certain scenarios, which can lead to a cross-site scripting XSS vulnerability. This is mitigated by the fact that both the attacker and the targeted user need to be using the Layout Builder editing interface...
ALPINE-CVE-2026-42533
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable i...
Drupal 10.6.x < 10.6.13 / 11.3.x < 11.3.14 / 11.4.x < 11.4.4 Multiple Vulnerabilities (drupal-2026-07-15)
According to its self-reported version, the instance of Drupal running on the remote web server is 10.6.x prior to 10.6.13, 11.3.x prior to 11.3.14, or 11.4.x prior to 11.4.4. It is, therefore, affected by multiple vulnerabilities. - Drupal core 11.2 and above integrate the HTMX JavaScript librar...
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012
The Layout Builder module doesn't sufficiently sanitize block labels in certain scenarios, which can lead to a cross-site scripting XSS vulnerability. This is mitigated by the fact that both the attacker and the targeted user need to be using the Layout Builder editing interface...
EUVD-2026-43553
A weakness has been identified in antv layout 2.0.0. This impacts the function setNestedValue in the library lib/util/object.js. Executing a manipulation of the argument path can lead to improperly controlled modification of object prototype attributes. The attack can be launched remotely. The...
CVE-2026-15598
A weakness has been identified in antv layout 2.0.0. This impacts the function setNestedValue in the library lib/util/object.js. Executing a manipulation of the argument path can lead to improperly controlled modification of object prototype attributes. The attack can be launched remotely. The...
CVE-2026-15598
The CVE affects antv layout 2.0.0, specifically the setNestedValue function in lib/util/object.js. A manipulation of the argument path can lead to prototype pollution, allowing remote modification of object prototype attributes. The advisory notes the attack can be launched remotely, with low att...
CVE-2026-15598 antv layout object.js setNestedValue prototype pollution
A weakness has been identified in antv layout 2.0.0. This impacts the function setNestedValue in the library lib/util/object.js. Executing a manipulation of the argument path can lead to improperly controlled modification of object prototype attributes. The attack can be launched remotely. The...
PYSEC-2026-3009 pypdf: Possible infinite loop when retrieving fonts for layout-mode text extraction
Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires extracting the text in layout mode. Patches This has been fixed in pypdf==6.13.0. Workarounds If you cannot upgrade yet, consider applying the changes from PR 3830...
PYSEC-2026-3016 pypdf: Possible large memory usage for large offsets for layout mode text
Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting text in layout mode with large character offsets. Patches This has been fixed in pypdf==6.12.0. Workarounds If developers are unable to immediately upgrade, they should...
Security Bulletin: Multiple log4j related security vulnerabilities in IBM Guardium Key Lifecycle Manager
Summary Multiple security vulnerabilities related to log4j have been addressed in IBM Guardium Key Lifecycle Manager Vulnerability Details CVEID:CVE-2026-34477 DESCRIPTION: The fix for CVE-2025-68161 https://logging.apache.org/security.htmlCVE-2025-68161 was incomplete: it addressed hostname...
