137466 matches found
SSTP Code Execution
The vulnerability of the Secure Socket Tunneling Protocol SSTP implementation in Windows operating systems is related to the reclamation of memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
AlmaLinux 9 : nodejs:22 (ALSA-2026:61383)
The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:61383 advisory. nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw CVE-2026-58043 nodejs: Node.js: Remote memory exhaustion via...
ALSA-2026:62218 Moderate: libssh security update
libssh is a library which implements the SSH protocol. It can be used to implement client and server applications. Security Fixes: libssh: libssh: denial of service via zero advertised channel packet size CVE-2026-59843 libssh: libssh: denial of service via oversized SFTP read length CVE-2026-598...
Moderate: libssh security update
libssh is a library which implements the SSH protocol. It can be used to implement client and server applications. Security Fixes: libssh: libssh: denial of service via zero advertised channel packet size CVE-2026-59843 libssh: libssh: denial of service via oversized SFTP read length CVE-2026-598...
Moderate: libssh security update
libssh is a library which implements the SSH protocol. It can be used to implement client and server applications. Security Fixes: libssh: libssh: denial of service via zero advertised channel packet size CVE-2026-59843 libssh: libssh: denial of service via oversized SFTP read length CVE-2026-598...
Malicious code in akanabi-aligfuh-aihmava (npm)
Source: amazon-inspector 649f73233df86e7ee27ecc6a996cc5b8f9ca41dbbaeb42641617f10c302b1688 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in ai-protocol (npm)
The package communicates with a domain associated with malicious activity. --- Credit: OpenSSF source...
Malicious code in agus-brengkes2-tititugel (npm)
Source: amazon-inspector 3ea4fe552f224c5afe2f2efb669e618ab4cf68bb73656b22efeca5b733ae3d17 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in agreed_flamingo_z3n (npm)
Source: amazon-inspector ea78cc197110c654af28492ce7d8cee3ea27e5875b33e4b0e0573fde9ce87177 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in afffffri-zidan-tea (npm)
Source: amazon-inspector c1e8893e7ac2f02aaeb4017d0fc4f11426d2c7ba7c2849fe83f73efa5fd50b40 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
GHSA-RGWJ-5XJ2-C3M3 MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS
Vulnerability Details File: lib/compressedprotocol.js Line: 43 zlib.inflatebody, err, data = ... inside handleCompressedPacket Root Cause When a connection is created with compress: true and the server advertises CLIENTCOMPRESS, every incoming packet is unwrapped by handleCompressedPacket in...
NPM: MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS
NPM: MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS vulnerability discovered by ? in WordPress Npm mysql2 versions = 3.23.0...
MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS
Vulnerability Details File: lib/compressedprotocol.js Line: 43 zlib.inflatebody, err, data = ... inside handleCompressedPacket Root Cause When a connection is created with compress: true and the server advertises CLIENTCOMPRESS, every incoming packet is unwrapped by handleCompressedPacket in...
Data Amplification
Overview mysql2 is a mostly API compatible with mysqljs and supports majority of features. Affected versions of this package are vulnerable to Data Amplification in the handleCompressedPacket function of lib/compressedprotocol.js, which calls zlib.inflatebody, ... without a maxOutputLength option...
zeek v9.0.0-rc2
The Zeek Network Security Monitor A powerful framework for network traffic analysis and security monitoring. Key Features — Documentation — Getting Started — Development — License Key Features In-depth Analysis Zeek ships with analyzers for many protocols, enabling high-level semantic analysis at...
CVE-2026-62380
A flaw was found in the Netty SOCKS client encoders. This vulnerability allows a remote attacker to inject null bytes or Carriage Return Line Feed CRLF characters into domain address and authentication fields due to insufficient validation. By manipulating these fields, an attacker can truncate o...
RHLW-2026-D0749BC5EF98B166 Lightwell Security Advisory: jsch 0.2.1.rhlw-00004
Red Hat Lightwell has released com.github.mwiede:jsch 0.2.1.rhlw-00004 with a backported security fix. CVE-2023-48795: The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some...
FreeRDP: FreeRDP: Denial of Service via integer underflow in RAIL channel handling
A flaw was found in FreeRDP. A remote attacker, by sending a specially crafted Remote Desktop Protocol RDP packet, could trigger a heap buffer overflow in the server-side RAIL channel handler. This vulnerability, caused by an integer underflow, allows the attacker to corrupt memory and crash the...
USN-8678-3: OpenSSL vulnerability
USN-8673-1 fixed vulnerabilities in OpenSSL. The update inadvertently left out the fix for CVE-2026-75803 in Ubuntu 26.04 LTS. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that OpenSSL incorrectly handled the QUIC server incoming...
Important: Red Hat Security Advisory: xmlrpc-c security update
An update for xmlrpc-c is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...