629288 matches found
Astra Linux – Vulnerability in dojo
All versions of the dojo package are vulnerable to Prototype Pollution through the setObject function...
Astra Linux – Vulnerability in edk2
EDK2’s Network Package is vulnerable to a buffer overflow vulnerability due to the long server ID option in DHCPv6 clients. This vulnerability can be exploited by an attacker to gain unauthorized access and may result in a loss of confidentiality, integrity, and/or availability...
Astra Linux – Vulnerability in edk2
EDK2’s Network Package is vulnerable to an out-of-bounds read vulnerability when processing the Neighbor Discovery Redirect message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially result in a loss of confidentiality...
Astra Linux – Vulnerability in opensc
A vulnerability was discovered in OpenSC. This security flaw causes a buffer overflow vulnerability in the cardoshaveverifyrcpackage function. An attacker can provide a smart card package with malformed ASN1 data. The cardoshaveverifyrcpackage function scans the ASN1 buffer for two tags, but the...
Astra Linux – Vulnerability in dpkg
In dpkg, the Debian package management system, versions prior to 1.21.8, 1.20.10, 1.19.8, and 1.18.26 are vulnerable to a directory traversal vulnerability. When extracting untrusted source packages in v2 and v3 source package formats that include debian.tar, the in-place extraction process may...
Astra Linux – Vulnerability in rpm
A flaw was discovered in RPM’s signature check functionality when reading a package file. This flaw allows an attacker who can persuade a victim to install a seemingly verifiable package, whose signature header was modified, to cause corruption of the RPM database and execute malicious code. The...
CLSA-2026-1789384355 TuxCare security update for 204 packages (1 CVE)
TuxCare rebuilt 204 packages to address 1 CVE. Fixed in 2.28.0-tuxcare.1...
@aliceo2/bookkeeping (>=1.19.0, <=1.20.0), @beyondnet/evolith-cli (>=1.2.0, <=1.3.2) +68 more potentially affected by CVE-2026-88932 via multer (>=2.2.0, <=2.3.0)
multer NPM version =2.2.0, =1.19.0, =1.2.0, =1.2.0, =2026.7.0, =5.7.5, =11.1.29-depup.0, =0.1.0, =0.1.0, =11.0.62, =1.2.34, =12.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.1 and more Source cves: CVE-2026-88932 Source advisory: SNYK:JS-MULTER-19785644...
ROOT-APP-NPM-CVE-2026-44489 CVE-2026-44489 in axios - Patched by Root
Root has patched CVE-2026-44489 in the axios package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-63376 CVE-2026-63376 in toml - Patched by Root
Root has patched CVE-2026-63376 in the toml package for Root:npm. Multiple fixed versions available...
CLSA-2026-1789379074 TuxCare security update for io.netty (22 CVEs)
TuxCare rebuilt 46 io.netty packages to address 22 CVEs. Fixed in 4.1.79.Final-tuxcare.4...
CLSA-2026-1789377089 TuxCare security update for org.springframework (4 CVEs)
TuxCare rebuilt 23 org.springframework packages to address 4 CVEs. Fixed in 5.2.0.RELEASE-tuxcare.5...
ROOT-APP-NPM-CVE-2026-42040 CVE-2026-42040 in axios - Patched by Root
Root has patched CVE-2026-42040 in the axios package for Root:npm. Multiple fixed versions available...
CLSA-2026-1789376303 TuxCare security update for 4 packages (1 CVE)
TuxCare rebuilt 4 packages to address 1 CVE. Fixed in 3.2.11-tuxcare.5...
CLSA-2026-1789369685 TuxCare security update for org.springframework.graphql (1 CVE)
TuxCare rebuilt 2 org.springframework.graphql packages to address 1 CVE. Fixed in 1.2.9-tuxcare.6...
CLSA-2026-1789368896 TuxCare security update for 2 packages (1 CVE)
TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 2.22.4.post9+tuxcare...
net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...
golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...
[SECURITY] Fedora 45 Update: rust-hickory-net-0.26.2-1.fc45
Hickory-net is a safe and secure low-level DNS library. This is the foundational DNS protocol library used by the other higher-level Hickory DNS crates...
Malicious code in webpackbootstrapscripts (npm)
[email protected] typosquats bootstrap and ships a disguised in-browser proxy kit. Its bundled loader index-z2b7r4.js XOR-decodes a list of endpoints with a fixed key and injects remote scripts from https://dyingefforlessefforlessours.com via document.head.appendChild, then boots a...