Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from issues with reference counting and cleanup timing. This vulnerability may lead to reuse of...

CVE-2026-33913: Improper Restriction of XML External Entity Reference

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an authenticated user with access to the Carecoordination module can upload a crafted CCDA document containing to read arbitrary files from the server. Version 8.0.0....

CVE-2026-23314: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: regulator: bq257xx: Fix device node reference leak in bq257xxregdtparsegpio In bq257xxregdtparsegpio, if fails to get subchild, it returns without calling ofnodeputchild, causing the device node reference leak...

CVE-2026-23284: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtkethsoc: Reset prog ptr to oldprog in case of error in mtkxdpsetup Reset eBPF program pointer to oldprog and do not decrease its ref-count if mtkopen routine in mtkxdpsetup fails...

CVE-2026-23350: Missing Release of Memory after Effective Lifetime

In the Linux kernel, the following vulnerability has been resolved: drm/xe/queue: Call fini on exec queue creation fail Every call to queue init should have a corresponding fini call. Skipping this would mean skipping removal of the queue from GuC list which is part of gucid allocation. A damaged...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the lack of reference counting for memory release, potentially leading to memory leaks...

CVE-2026-23291: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: properly drop the usb interface reference on disconnect When the device is disconnected from the driver, there is a "dangling" reference count on the usb interface that was grabbed in the probe callback. Fix this up b...

cryptodev-linux 资源管理错误漏洞

cryptodev-linux is an open-source Linux kernel encryption device driver developed by cryptodev-linux. Versions of cryptodev-linux prior to 1.14 contain a resource management vulnerability. This vulnerability stems from a page reference handling flaw in the getuserbuf function of the /dev/crypto...

CVE-2026-33331 oRPC: Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify

oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.9, a stored cross-site scripting XSS vulnerability exists in the OpenAPI documentation generation of orpc. If an attacker can control any field within the OpenAPI specificati...

CVE-2026-33331

CVE-2026-33331 affects orpc prior to version 1.13.9, exposing a stored XSS in the OpenAPI documentation generation. If an OpenAPI spec field (eg. info.description) is attacker-controlled, the rendered docs can break out of a JSON context and execute arbitrary JavaScript in a user’s browser. Red H...

CVE-2026-33331 oRPC: Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify

oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.9, a stored cross-site scripting XSS vulnerability exists in the OpenAPI documentation generation of orpc. If an attacker can control any field within the OpenAPI specificati...

Security Bulletin: IBM InfoSphere Information Server is vulnerable due to Insecure Direct Object Reference (CVE-2025-14974)

Summary A vulnerability due to Insecure Direct Object Reference in IBM InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2025-14974 DESCRIPTION: IBM InfoSphere Information Server is vulnerable due to Insecure Direct Object Reference IDOR. CWE:CWE-639: Authorization Bypa...

MAL-2026-2363 Malicious code in env-extend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b65432f04e2d76673de1e30fd9afbce2259306e45f6590848f02eb6f72535333 The package env-extend was found to contain malicious code...

CVE-2026-33678

Vikunja prior to 2.2.1 suffers an IDOR: TaskAttachment.ReadOne() queries by attachment ID only and ignores the URL task_id, allowing any authenticated user to access or delete attachments across projects by supplying their own task_id. The read path validates the URL task, but ReadOne() loads the...

DarKSward

DarKSward-DarKSword Webpack source code reconstruction of the...

CVE-2026-33484

Langflow exposes an unauthenticated IDOR on image downloads via /api/v1/files/images/{flow_id}/{file_name} in versions 1.0.0–1.8.1. An attacker who can discover or guess a flow_id can download any user’s uploaded images without credentials in multi-tenant deployments. A patch is available in vers...

Malicious Package

Overview yelp-react-component-badge is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview yelp-react-component-rating is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

CVE-2026-4754

creationtimestamp| type| source ---|---|--- 2026-03-24 10:05:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhsd6nyubb2g...

The vulnerability of the ceph_mds_check_access() function in the fs/ceph/mds_client.c module, a part of the distributed file system Ceph support for Linux operating systems, allows a attacker to gain unauthorized access to protected information.

The vulnerability of the cephmdscheckaccess function in the fs/ceph/mdsclient.c module of the distributed file system support module for Linux operating systems is related to errors during the update of the reference counter. Exploiting this vulnerability can allow an attacker to gain unauthorize...