255386 matches found
CVE-2026-63136
Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130. A user with search privileges can submit a specially crafted search request that causes a data node to exhaust available heap memory, resulting in node unavailability and...
CVE-2026-63140
CVE-2026-63140 describes a Reachable Assertion (CWE-617) in Elasticsearch that can cause denial of service. A specially crafted search containing a null value in a specific query clause triggers an internal assertion during query parsing, which Elasticsearch treats as a fatal error and terminates...
MAL-2026-10979 Malicious code in @apexfdn/apex (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbc2117528ff8a612341edb673a46c0ced3745bccf0c4c60f3b7cdf86d501af3 On npm install, install.js runs as a postinstall step and downloads a platform-specific executable from...
Malicious code in @apexfdn/apex (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbc2117528ff8a612341edb673a46c0ced3745bccf0c4c60f3b7cdf86d501af3 On npm install, install.js runs as a postinstall step and downloads a platform-specific executable from...
CVE-2026-59141
Data::RadixTree::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated node and arena indices in rdxfindlocked. The attach-time validator rdxvalidateheader checks the header scalars and region layout against the file size, but does not validate the node records it then...
GHSA-VCRF-J523-4MRF aws-cdk-lib: OS Command Injection in NodejsFunction Docker Bundling
Summary AWS CDK aws-cdk-lib is an open-source framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation. OS command injection issue in the NodejsFunction Docker bundling pipeline in aws-cdk-lib before 2.260.0 that might allow an actor who controls dependen...
CVE-2026-59141
Data::RadixTree::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated node and arena indices in rdxfindlocked. The attach-time validator rdxvalidateheader checks the header scalars and region layout against the file size, but does not validate the node records it then...
CVE-2026-59141 Data::RadixTree::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated node and arena indices in rdx_find_locked
Data::RadixTree::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated node and arena indices in rdxfindlocked. The attach-time validator rdxvalidateheader checks the header scalars and region layout against the file size, but does not validate the node records it then...
CVE-2026-59140
Data::SortedSet::Shared versions before 0.03 for Perl allow an out-of-bounds read via unvalidated node indices in the rank and min/max query paths. The attach-time validator ssvalidateheader bounds only the root index against the node pool nodecapacity. The order-statistics and min/max queries th...
CVE-2026-59140
CVE-2026-59140 affects Data::SortedSet::Shared
EUVD-2026-42315
Immutabl: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set...
GHSA-FRVP-7C67-39W9 Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)
The same as the hono core Path traversal in serve-static on Windows via encoded backslash %5C. Summary On Windows hosts, an encoded backslash %5C in the request path decodes to , which the Windows path resolver treats as a separator. serve-static then resolves a single URL segment such as...
MAL-2026-10984 Malicious code in veskra (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f85333fa48c61a31c9f7be395bdc5ef70596e317a3bc9124f67ece4ffcf96901 [email protected] contains six files with no static or behavioral indicators of supply-chain attack: no lifecycle scripts fetching remote content, no...
MAL-2026-10980 Malicious code in nolby (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a8bc0fa5eb23a45d27933ce1d32b7fabed27182039e170dbcaa38c0462dfa20 The package advertises itself as a pure calendar/streak math library with no import-time side effects, but index.mjs invokes a top-level sync on modu...
OPENSUSE-SU-2026:21399-1 Security update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-repos, cockpit-subscriptions
This update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-repos, cockpit-subscriptions fixes the following issues: Security issues fixed: - CVE-2025-13465: lodash: prototype pollution in the .unset and .omit functions can lead to deletion of methods from global prototyp...
GHSA-W8WR-V893-VJVP vulnerabilities
Vulnerabilities for packages: homepage, prism, actions-runner, gitlab-rails-ce, kubeflow-centraldashboard, gitlab-rails-ce-fips, lerna, opensearch-dashboards-fips, graalvm, code-server, sqlpad, wazuh-dashboard-fips, saf, wazuh-dashboard, opensearch-dashboards, pulumi, npm, kibana...
GHSA-8X88-C5MF-7J5W vulnerabilities
Vulnerabilities for packages: homepage, prism, actions-runner, gitlab-rails-ce, kubeflow-centraldashboard, gitlab-rails-ce-fips, lerna, opensearch-dashboards-fips, graalvm, code-server, sqlpad, wazuh-dashboard-fips, saf, wazuh-dashboard, opensearch-dashboards, pulumi, npm, kibana...
GHSA-23HP-3JRH-7FPW vulnerabilities
Vulnerabilities for packages: homepage, prism, actions-runner, gitlab-rails-ce, kubeflow-centraldashboard, gitlab-rails-ce-fips, lerna, opensearch-dashboards-fips, graalvm, code-server, sqlpad, wazuh-dashboard-fips, saf, wazuh-dashboard, opensearch-dashboards, pulumi, npm, kibana...
GHSA-GVWX-54WH-QM9J vulnerabilities
Vulnerabilities for packages: prism, actions-runner, gitlab-rails-ce, kubeflow-centraldashboard, gitlab-rails-ce-fips, lerna, opensearch-dashboards-fips, graalvm, code-server, sqlpad, wazuh-dashboard-fips, saf, wazuh-dashboard, opensearch-dashboards, pulumi, npm, kibana...
