15438 matches found
CVE-2026-6424
Use-after-free vulnerability in ESET Linux products potentially allowed an attacker to trigger kernel panic on the system...
CVE-2026-6424 Use-after-free vulnerability in ESET security products for Linux
Use-after-free vulnerability in ESET Linux products potentially allowed an attacker to trigger kernel panic on the system...
EUVD-2026-44903
Use-after-free vulnerability in ESET Linux products potentially allowed an attacker to trigger kernel panic on the system...
CVE-2026-6424
Use-after-free vulnerability in ESET Linux products potentially allowed an attacker to trigger kernel panic on the system...
CVE-2026-6424 Use-after-free vulnerability in ESET security products for Linux
Use-after-free vulnerability in ESET Linux products potentially allowed an attacker to trigger kernel panic on the system...
CVE-2026-6424
Technical details on CVE-2026-6424 are not publicly available in the provided documents. No information on affected products, versions, root cause, or mitigations. Monitor for updates.
Amazon Linux 2023 : rclone (ALAS2023-2026-1923)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1923 advisory. The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size. CVE-2026-46601 The TIFF decoder does not set a limit on the size of tiles in tiled...
CVE-2026-46377: Improper Validation of Array Index
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the escape sequence handler in Tokenizer.parseCurRune in selector/lexer/tokenize.go increments past a trailing backslash in a quoted string such as "\ or '\ and then reads...
CVE-2026-6424: Use After Free
Use-after-free vulnerability in ESET Linux products potentially allowed an attacker to trigger kernel panic on the system...
PT-2026-60581
CoreDNS is a DNS server written in Go. Prior to 1.14.5, the CoreDNS rewrite plugin supports edns0 rewrite rules with an optional revert flag, and two response rules, edns0SetResponseRule and edns0ReplaceResponseRuleT in plugin/rewrite/edns0.go, call res.IsEdns0 and immediately dereference the...
CVE-2026-62994: Uncaught Exception
CoreDNS is a DNS server written in Go. From 1.9.4 until 1.14.5, a network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with k8sexternal headless-service zone transfers and Kubernetes contains a headless service endpoint with no declared port...
PT-2026-60449
Name of the Vulnerable Software and Affected Versions ESET Linux products affected versions not specified Description A use-after-free issue exists in ESET Linux products. This occurs when a program continues to use a pointer after it has been freed, which could allow an attacker to trigger a...
PT-2026-60668
Vulnerability report without repro case. Repro case may be added later after harness is complete. Preconditions 4: - Tenant has SecurityPolicy + TCPRoute RBAC baseline - Tenant namespace permitted to attach TCPRoute to a Gateway listener - spec.authorization omitted the trigger - No admission...
CVE-2026-15449: Time-of-check Time-of-use (TOCTOU) Race Condition
A time-of-check to time-of-use TOCTOU flaw in the illumos data-link pseudo-driver dld affects handling of the DLDIOCGETMACPROP and DLDIOCSETMACPROP ioctls on /dev/dld. drviocpropcommon in usr/src/uts/common/io/dld/dlddrv.c copies the dldiocmacpropt ioctl header in once to read its prvalsize field...
serde_with: KeyValueMap serialization panics on empty sequence or map entries
Summary The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through serdeasas =...
GHSA-7GCF-G7XR-8HXJ serde_with: KeyValueMap serialization panics on empty sequence or map entries
Summary The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through serdeasas =...
SUSE CVE-2026-54063
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the checkSheet function in github.com/xuri/excelize/v2 uses an attacker-controlled XML attribute value directly as the length argument to makexlsxRow, row without validating it against the Exc...
SUSE CVE-2026-59162
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, Excelize parses shared-string cell values with strconv.Atoi and checks only the upper bound before indexing the shared string slice, allowing an XLSX file containing a shared-string cell with ...
PT-2026-60657
Summary The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through serde asas =...
Uncaught Exception
Overview std/net is a Go standard library package std/net Affected versions of this package are vulnerable to Uncaught Exception. Go Vulnerability Report:Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. Remediation Upgrade std/net to...