CVE-2025-15647

CDT before 1.4.5 contains an out-of-bounds read vulnerability in the opposedVertexInd function when constraint edge intersections are computed in floating point and round outside adjacent triangles. Attackers can supply nearly-degenerate constraint edges through geometry data to trigger an...

CVE-2026-86185 Bilibili Desktop through 1.18.0 Remote Code Execution via TLS Verification Bypass

Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An attacker in an on-path network position can intercept configuration fetches, inject arbitrary JavaScript executed in the renderer...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference in the xmlRegNewParserCtxt function of the xmlregexp component when the strlen function is called on a potentially NULL pointer before verifying the result of a memory allocation. An attacker can cause a process...

SUSE CVE-2026-85048

Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-85052

Out of bounds read in CrashReporting in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-85534

A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flow-control window later allows. A malicious HTTP/2 server can shrink SETTINGSINITIALWINDOWSIZE while that buffered read is still in progres...

PT-2026-86444

Name of the Vulnerable Software and Affected Versions libpcap affected versions not specified Description The BPF interpreter fails to detect when the end of the filter program buffer is reached due to a missing return instruction, or when a jump instruction uses an offset that points outside the...

Linux Distros Unpatched Vulnerability : CVE-2026-31911

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libpcap BPF interpreter calls abort if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a crafted filter program can...

CVE-2026-53604

nebula-mesh (a self-hosted control plane for Slack Nebula mesh VPN by forgekeep ) is affected by a key-zeroization flaw in its web UI mobile-bundle path. The renderMobileBundle handler passes a decrypted *pki.CAManager containing the CA's ed25519 private key into mobilebundle.Build, which never c...

Uncaught Exception

Overview org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Uncaught Exception in the WebSocketStream API, whose socket-close handler calls abort on the writable stream while the application holds a writer lock and...

CVE-2026-85024

A flaw was found in undici. A remote, unauthenticated attacker can trigger a Denial of Service DoS by sending a specially crafted compressed WebSocket payload. When this payload exceeds the 128 MiB decompressed-payload limit and contains a malformed DEFLATE byte, it causes an unhandled error in t...

CVE-2026-85656

An OS command injection issue in the log4j-cve-2021-44228-hotpatch package in Amazon Linux before 1.3-9 might allow a local user to execute arbitrary commands with root privileges via a Java process whose executable path contains embedded newline characters...

DEBIAN-CVE-2026-19534

undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undic...

UBUNTU-CVE-2026-19534

undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undic...

K000163212: BIND vulnerability CVE-2026-13204

Security Advisory Description If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 versions 9.11.0...

CVE-2026-19534

A flaw was found in undici. A remote attacker can exploit this vulnerability by responding with an unrequested WebSocket subprotocol during the opening handshake. This causes the undici WebSocket client to crash the entire Node.js process, leading to a denial of service DoS. Mitigation Mitigation...

CVE-2026-85014

undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writable stream unconditionally and discards the returned...

DEBIAN-CVE-2026-85024

undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit. When a remote peer sends a compressed payload that crosses the built-in 128 MiB...

CVE-2026-19534 undici vulnerable to Denial of Service via unrequested WebSocket subprotocol

undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undic...

CVE-2026-85014

undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writable stream unconditionally and discards the returned...