EulerOS 2.0 SP13 : python-idna (EulerOS-SA-2026-3039)

According to the versions of the python-idna package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and...

Linux Distros Unpatched Vulnerability : CVE-2026-14587

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way it treats a truncated bit mask. When an unauthenticated client sends a...

Linux Distros Unpatched Vulnerability : CVE-2026-45537

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the constructuri function concatenates multiple U...

EulerOS 2.0 SP13 : python-idna (EulerOS-SA-2026-2989)

According to the versions of the python-idna package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and...

Malicious code in test22221 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4a3401759b5c6d7effdafcbae6027657e3cf8f9aabf1f04dfc2fa9039b64e53 package.json declares preinstall and postinstall lifecycle hooks that run on npm install. Both hooks curl a hardcoded bare-IP endpoint over plain HTT...

EUVD-2026-53352

microtar's mtarwritefileheader and mtarwritedirheader functions src/microtar.c copy a caller-supplied entry name into the 100-byte name field of a stack-allocated mtarheadert via strcpyh.name, name, with no check that strlenname is less than 100 before the copy. Any application that calls these...

CVE-2026-55997

CVE-2026-55997 concerns Rancher where long-lived registration tokens used to authenticate nodes/agents into a downstream cluster were stored in plaintext with no expiration. The tokens could be obtained via the Rancher API, etcd, automation, or direct file access on a node and used at any time to...

CVE-2026-55997 Long-lived Rancher registration token exposed in plaintext

Rancher issues long-lived registration tokens to authenticate nodes and agents joining a downstream cluster. These tokens were stored and exposed in plaintext with no expiration, so a malicious user could obtain one either through the Rancher API, etcd, stored automation, or direct file access on...

CVE-2026-45809

OpenSIPS is a Session Initiation Protocol SIP server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the watcherinfo generation functionality. An attacker can create an oversized watcher entry by sending a SUBSCRIBE Event: presence request with a...

CVE-2026-45537

OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the constructuri function concatenates multiple URI components protocol, username, domain, port, params into a fixed 1024-byte global BSS buffer without any bounds checking. When a routi...

CVE-2026-45537 OpenSIPS: Global Buffer Overflow in construct_uri

OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the constructuri function concatenates multiple URI components protocol, username, domain, port, params into a fixed 1024-byte global BSS buffer without any bounds checking. When a routi...

CVE-2026-45537

OpenSIPS contains a buffer overflow in construct_uri() used to assemble SIP URIs. In versions before 3.6.6 and 4.0.0-rc1, components (protocol, username, domain, port, params) are concatenated into a fixed 1024-byte global BSS buffer without bounds checks. If a routing script supplies a long, att...

CVE-2026-45538

OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions 4.0.0 and prior, processing a SIP message with a header name longer than 255 bytes causes a stack buffer overflow when siptojson is called in the routing script. Function siptojson modules/sipmsgops/sipmsgops.c copie...

CVE-2026-45538 OpenSIPS: Stack Buffer Overflow in sip_to_json() Header Name Copy

OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions 4.0.0 and prior, processing a SIP message with a header name longer than 255 bytes causes a stack buffer overflow when siptojson is called in the routing script. Function siptojson modules/sipmsgops/sipmsgops.c copie...

Memory Allocation with Excessive Size Value

Overview Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the checkforlanguage function. An attacker can exhaust system memory by submittin...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

UBUNTU-CVE-2026-15337

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.utils.translation.checkforlanguage is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory...

CVE-2026-15337 Potential denial-of-service vulnerability in check_for_language()

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.utils.translation.checkforlanguage is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory...

CVE-2026-15337 Potential denial-of-service vulnerability in check_for_language()

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.utils.translation.checkforlanguage is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory...

CVE-2026-15337

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.utils.translation.checkforlanguage is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory...