PT-2026-99853

Name of the Vulnerable Software and Affected Versions elixir-mint versions 0.1.0 through 1.10.x Description A resource allocation issue allows a malicious HTTP/2 server to force a client to buffer up to approximately 16 MiB per connection in frames that should be rejected, leading to excessive...

PT-2026-99852

Name of the Vulnerable Software and Affected Versions mint versions 1.1.0 through 1.10.x Description A malicious HTTP/2 server can cause a denial of service by exhausting memory on the client host. The issue occurs because Mint.HTTP2 only enforces the max header list size setting on the compresse...

CVE-2026-18416: Out-of-bounds Read

The CoAP link-format helper matchpathuri in subsys/net/lib/coap/coaplinkformat.c compares a registered resource path against the URI carried in a Uri-Query href= option. That URI is not NUL terminated, but the inner character loop advanced its index k once per path character without ever testing ...

PT-2026-102355

Name of the Vulnerable Software and Affected Versions ZoAP versions 1.8.0 through 1.9.x Description The CoAP link-format helper match path uri in subsys/net/lib/coap/coap link format.c contains an out-of-bounds read. The issue occurs when comparing a registered resource path against a URI in a...

PT-2026-99854

Name of the Vulnerable Software and Affected Versions elixir-mint versions 0.1.0 through 1.10.x Description An inconsistent interpretation of HTTP requests, known as HTTP Request/Response Smuggling, allows a malicious HTTP/1 server to desynchronize an intermediary and the Mint client on a pooled...

CVE-2026-101905: Unintended Proxy or Intermediary

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value. A separate same-process prototype-pollution flaw places a function on...

ROS-20260928-73-0013

The vulnerability of the copyfromuser and copytouser functions in the arch/sparc/lib/U1memcpy.S module of the Linux operating system is related to the lack of checking the return value. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

PT-2026-102412

Name of the Vulnerable Software and Affected Versions Zephyr LwM2M client affected versions not specified Description The parse write op function in subsys/net/lib/lwm2m/lwm2m message handling.c contains a NULL pointer dereference when handling inbound CoAP WRITE/CREATE requests with a Block1...

ROS-20260928-73-0011

The vulnerability of the copyfromuser function in the arch/sparc/lib/U3memcpy.S file of the Linux operating system’s kernel is related to the lack of a check on the returned value. Exploiting this vulnerability could allow an attacker to cause a service failure remotely...

curl: Use-after-free read of the freed referer buffer in `curl_easy_setopt(CURLOPT_REFERER)` — stale heap bytes transmitted in an outbound `Referer:` heade

CWE-416 → CWE-908/CWE-200 Aset yang terdampak Affected Asset - Component: libcurl — lib/setopt.c, CURLOPTREFERER handler curleasysetopt API - Related code paths: lib/bufref.c Curlbufreffree, CURLINFOREFERER getter lib/getinfo.c:145, referer emission lib/http.c:2941-2945, pretransfer sync...

Uncaught Exception

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Uncaught Exception via the host-to-sandbox promise delivery path in lib/bridge.js, where a host promise reaching the sandbox through the construct...

Exposure of Resource to Wrong Sphere

Overview org.webjars.npm:vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere via the bufferFrom and related Buffer factory functions in lib/setup-sandbox.js, where Node.js...

Incorrect Authorization

Overview org.webjars.npm:vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Incorrect Authorization via LegacyResolver.isPathAllowed in lib/resolver-compat.js, which uses a raw path.startsWithmod.path check to...

CVE-2026-100721 vm2 before 3.12.2 Authorization Bypass via Custom Resolver

vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures require.external with a custom resolver and context: 'host', LegacyResolver.customResolve in lib/resolver-compat.js records the resolved module directory in this.externals as new...

CVE-2026-100713 Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync

Froxlor 2.3.10 and earlier contain a time-of-check time-of-use TOCTOU race condition in the SSH key synchronization cron lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles. The containment/symlink validation performed by FileDir::makeCorrectDir/makeCorrectFile is done only at check time;...

CVE-2026-100713 Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync

Froxlor 2.3.10 and earlier contain a time-of-check time-of-use TOCTOU race condition in the SSH key synchronization cron lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles. The containment/symlink validation performed by FileDir::makeCorrectDir/makeCorrectFile is done only at check time;...

CVE-2026-100714: Improper Neutralization of Argument Delimiters in a Command

Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting: unlike sibling settings hardened in GHSA-33mp, the field has no stringregexp or requiredotp guard, and its value is concatenated unescaped into the acme.sh command line built in...

MAL-2026-17326 Malicious code in @zeronexcode/baileys (npm)

makeWASocket in lib/Socket/index.js makes the user's WhatsApp account follow the hardcoded channel 120363427099186895@newsletter whenever a connection opens, with no option to disable it. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector...

Malicious code in @zeronexcode/baileys (npm)

makeWASocket in lib/Socket/index.js makes the user's WhatsApp account follow the hardcoded channel 120363427099186895@newsletter whenever a connection opens, with no option to disable it. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector...

OESA-2026-4119 alsa-lib security update

The alsa-lib is a library to interface with ALSA in the Linux kernel and virtual devices using a plugin system. More detail: https://alsa.opensrc.org/Alsa-lib Security Fixes: alsa-lib through 1.2.16.1 contains a stack buffer overflow in the sndctlasciielemidparse function that writes one byte pas...