Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the validate input size of hashtags in HTTP requests. An attacker can exhaust CPU resources by submitting a single HTTP request containing a post with thousands of space-separated...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001636)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001636 advisory. It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster...

Dive code injection vulnerability

Dive is a desktop application for MCP hosts, open-sourced by OpenAgentPlatform. Versions of Dive prior to 0.13.0 contained a code injection vulnerability. This vulnerability stemmed from specially crafted deep links that allowed the installation of MCP server configurations controlled by attacker...

MiracleLinux 7 : firefox-60.2.1-1.0.1.el7.AXS7 (AXSA:2018-3344:06)

The remote MiracleLinux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2018-3344:06 advisory. Mozilla: Crash in TransportSecurityInfo due to cached data CVE-2018-12385 Mozilla: Setting a master password post-Firefox 58 does not delete...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001121)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001121 advisory. A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network who is able to alte...

CVE-2025-68783

An out-of-bounds write flaw was found in the Linux kernel's ALSA USB mixer driver for Tascam US-16x08 audio interfaces. The getmeterlevelsfromurb function extracts channel indices from USB packets without validating the range. A malicious or malfunctioning USB device can send packets with...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002520)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002520 advisory. Stack-based buffer overflow in the ttusbdecfedvbsdiseqcsendmastercmd function in drivers/media/usb/ttusb-dec/ttusbdecfe.c in the Linux kernel before 3.17.4 allows...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003233)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003233 advisory. It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the gbufferedinputstreampeek function. An attacker can cause application crashes by providing specially crafted input that triggers an integer overflow. Remediation A fix was pushed into the master...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion via the xmlCatalogXMLResolveURI function when processing XML catalogs containing self-referencing delegate URI entries. An attacker can cause affected applications to crash by supplying a specially crafted XML...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002778)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002778 advisory. It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-002997)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002997 advisory. A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network who is able to alte...

Missing Release of Memory after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime via the mpegl3encoderinit function. An attacker can cause excessive memory consumption by repeatedly invoking this function, potentially leading to resource exhaustion. Remediation A fi...

Double Free

Overview Affected versions of this package are vulnerable to Double Free in the Regexp compilation process. An attacker can execute arbitrary code or cause a denial of service by supplying a specially crafted regular expression source string. Remediation A fix was pushed into the master branch bu...

ROS-20260113-7355

A vulnerability in the cdnsi3cmasterremove function in the drivers/i3c/master/i3c-master-cdns.c module of the Linux kernel is related to the reuse of previously freed memory due to competitive access to a resource race condition. Exploitation of the vulnerability may allow an intruder to affect t...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference in the Parser::parsebinary function. An attacker can cause a denial of service by triggering a null pointer dereference through local access. Remediation A fix was pushed into the master branch but not yet...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference via the SubtableUnicodesCache::create function when memory allocation fails and the return value is not checked before object construction. An attacker can cause a segmentation fault and crash the process by...

CVE-2023-49058

SAP Master Data Governance File Upload application allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing ‘traverse to parent directory’ are passed through to the file APIs. As a result, it has a low impact to the confidentiality...

CVE-2023-45391

A stored cross-site scripting XSS vulnerability in the Create A New Employee function of Granding UTime Master v9.0.7-Build:Apr 4,2023 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the First Name parameter...

CVE-2021-28373

The authinternal plugin in Tiny Tiny RSS aka tt-rss before 2021-03-12 allows an attacker to log in via the OTP code without a valid password. NOTE: this issue only affected the git master branch for a short time. However, all end users are explicitly directed to use the git master branch in...