Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the improper restoration of writable and soft dirty bits during batch processing, potentially...

CVE-2026-28373

The Stackfield Desktop App before 1.10.2 for macOS and Windows contains a path traversal vulnerability in certain decryption functionality when processing the filePath property. A malicious export can write arbitrary content to any path on the victim's filesystem...

Security update for osslsigncode (critical)

openSUSE Security Update: Security update for osslsigncode Announcement ID: openSUSE-SU-2026:0115-1 Rating: critical References: 1260680 Cross-References: CVE-2025-70888 Affected Products: openSUSE Backports SLE-15-SP6 An update that fixes one vulnerability is now available. Description: This...

Rack has quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header

Summary Rack::Utils.selectbestencoding processes Accept-Encoding values with quadratic time complexity when the header contains many wildcard entries. Because this method is used by Rack::Deflater to choose a response encoding, an unauthenticated attacker can send a single request with a crafted...

PYSEC-2026-2299

vLLM is an inference and serving engine for large language models LLMs. From version 0.5.5 to before version 0.18.0, Librosa defaults to using numpy.mean for mono downmixing tomono, while the international standard ITU-R BS.775-4 specifies a weighted downmixing algorithm. This discrepancy results...

CVE-2025-43202

This issue was addressed with improved memory handling. This issue is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6. Processing a file may lead to memory corruption...

CVE-2026-34760 vLLM: Downmix Implementation Differences as Attack Vectors Against Audio AI Models

vLLM is an inference and serving engine for large language models LLMs. From version 0.5.5 to before version 0.18.0, Librosa defaults to using numpy.mean for mono downmixing tomono, while the international standard ITU-R BS.775-4 specifies a weighted downmixing algorithm. This discrepancy results...

CVE-2026-34760 vLLM: Downmix Implementation Differences as Attack Vectors Against Audio AI Models

vLLM is an inference and serving engine for large language models LLMs. From version 0.5.5 to before version 0.18.0, Librosa defaults to using numpy.mean for mono downmixing tomono, while the international standard ITU-R BS.775-4 specifies a weighted downmixing algorithm. This discrepancy results...

GO-2026-4891 act: Unrestricted set-env and add-path command processing enables environment injection in github.com/nektos/act

act: Unrestricted set-env and add-path command processing enables environment injection in github.com/nektos/act...

CVE-2026-34426

OpenClaw is affected in versions prior to commit b57b680, due to inconsistent environment variable normalization between approval and execution paths. This allows attackers to inject attacker-controlled environment variables into execution without proper approval validation, by exploiting differi...

CVE-2025-43264

CVE-2025-43264 affects Apple macOS Sequoia, with the issue tied to memory handling in image processing that can corrupt process memory. The vulnerability is fixed in macOS Sequoia 15.6. According to the provided metrics, the CVSS v3.1 base score is 8.8 (High) with an attack vector of NETWORK, att...

CVE-2025-43202

This issue was addressed with improved memory handling. This issue is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6. Processing a file may lead to memory corruption...

CVE-2025-43202

This CVE (CVE-2025-43202) concerns memory handling in Apple platforms. Affects Apple iOS and iPadOS before 18.6 and macOS Sequoia before 15.6; processing a file may lead to memory corruption due to the underlying memory handling issue. The issue is fixed in iOS 18.6, iPadOS 18.6, and macOS Sequoi...

CVE-2026-34826

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.getbyteranges parses the HTTP Range header without limiting the number of individual byte ranges. Although the existing fix for CVE-2024-26141 rejects ranges whose total byte coverage exceeds the...

GHSA-H4WV-G838-66G3 Keycloak: Application-Level DoS via Scope Processing

A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect OIDC token endpoint. This leads to high resource consumption and prolonged processing times, ultimate...

Libarchive: libarchive: arbitrary code execution via integer overflow in iso9660 image processing

...

CVE-2026-5314

A flaw was found in Nothings stb, specifically within the stbttInitFontinternal function in the stbtruetype.h library. A remote attacker can exploit this vulnerability by performing a manipulation that leads to an out-of-bounds read. This can result in a Denial of Service DoS, making the affected...

CVE-2026-5317

A flaw was found in Nothings stb, a library used for processing audio. A remote attacker can exploit a vulnerability involving an out-of-bounds write within the startdecoder function. This issue could allow an attacker to cause the application to crash, disclose sensitive information, or corrupt...

Rack 安全漏洞

Rack is a modular Ruby web server interface developed by Rack authors. Vulnerabilities exist in versions of Rack prior to 2.2.23, 3.1.21, and 3.2.6. These vulnerabilities stem from Rack::Utils.selectbestencoding, which has a quadratic time complexity when processing Accept-Encoding headers...

FreeRDP Out-of-Bounds Read Vulnerability (CNVD-2026-16034)

FreeRDP is an open source Remote Desktop Protocol RDP implementation library and client . FreeRDP suffers from an out-of-bounds read vulnerability. The vulnerability arises due to a mismatch in the persistent cache allocator, which results in an out-of-bounds read of heap memory when processing...