pip: pip: Information disclosure via path traversal when installing crafted wheel archives

A flaw was found in pip. A remote attacker could exploit this path traversal vulnerability by tricking a user into installing a maliciously crafted wheel archive. This could lead to files being extracted outside the intended installation directory, potentially disclosing sensitive information...

CVE-2026-35205

A flaw was found in Helm, a package manager for Kubernetes. A remote attacker could exploit this vulnerability by providing a malicious plugin that lacks a provenance file. Even when signature verification is enabled, Helm would incorrectly install this unverified plugin, bypassing critical...

cpython: cpython: `tarfile` module misinterprets crafted tar archives leading to data integrity issues

A flaw was found in the tarfile module of cpython. This vulnerability allows a remote attacker to craft a malicious tar archive that, when processed, could be misinterpreted by the tarfile module. This misinterpretation occurs because the module incorrectly applies normalization of AREGTYPE block...

bind: Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation

A flaw was found in the BIND Berkeley Internet Name Domain DNS-over-HTTPS implementation. A remote attacker could send specially crafted HTTP/2 traffic to a DNS-over-HTTPS endpoint, leading to a use-after-free vulnerability. This could trigger memory corruption, potentially allowing the attacker ...

CVE-2026-31412

A flaw was found in the Linux kernel's USB mass storage gadget module usb-gadget-fmassstorage. A remote attacker, acting as a malicious USB host, could send a specially crafted SCSI READ or WRITE command. This action could trigger an integer overflow during data size calculation, leading to an...

golang.org/x/crypto/ssh/agent: SSH Agent servers: Denial of Service due to malformed messages

A flaw was found in the SSH Agent servers component golang.org/x/crypto/ssh/agent. This vulnerability allows a remote attacker to cause a denial of service DoS by sending a specially crafted, malformed message during new identity requests. The server fails to validate the size of these messages,...

golang.org/net/http: Lack of limit when parsing cookies can cause memory exhaustion in net/http

A flaw was found in golang.org/net/http. A remote attacker could exploit this vulnerability by sending a large number of small cookies to an HTTP server. Despite a default 1MB limit on HTTP headers, the number of cookies parsed is unrestricted, leading to excessive memory allocation. This can cau...

crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation

A flaw was found in Go's crypto/x509 package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service DoS for...

js-yaml: js-yaml: Denial of Service via quadratic CPU time parsing with merge keys

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. When merge keys are enabled, a remote attacker could exploit this vulnerability by crafting a YAML document where a chain of mappings uses merge keys, each merging the previous one. This can lead to a significant increase in CPU ti...

CVE-2026-4660

A flaw was found in the go-getter library. A remote attacker could exploit this vulnerability by providing a maliciously crafted URL during certain git operations. This could allow the attacker to perform arbitrary file reads on the file system, potentially leading to the disclosure of sensitive...

EUVD-2026-21214

Heap buffer overflow in DTLS 1.3 ACK message processing. A remote attacker can send a crafted DTLS 1.3 ACK message that triggers a heap buffer overflow...

Synology SSL VPN Client 安全漏洞

The Synology SSL VPN Client is a VPN client software developed by Synology, a Chinese company, used for secure connection to Synology NAS devices. Versions of the Synology SSL VPN Client prior to 1.4.5-0684 contained security vulnerabilities. These vulnerabilities stemmed from externally accessib...

ROS-20260410-73-0015

Vulnerability in curl related to authentication bypass due to an initial bug. Exploitation of the vulnerability could allow an attacker acting remotely to escalate their privileges...

ROS-20260410-73-0016

Vulnerability in curl related to authentication bypass due to an initial bug. Exploitation of the vulnerability could allow an attacker acting remotely to escalate their privileges...

PT-2026-31928

Cross Site Scripting vulnerability in Altenar Sportsbook Software Platform SB2 v.2.0 allows a remote attacker to obtain sensitive information and execute arbitrary code via the URL parameter...

The vulnerability of Google Chrome browser’s Blink rendering module allows a hacker to trigger a service failure.

The vulnerability of Google Chrome’s Blink rendering module is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability can allow a remote attacker to cause a service failure through a specially created web page...

The vulnerability of the software for interacting with servers via cURL lies in the ability to utilize memory after it is released, allowing a hacker to cause a service failure.

The vulnerability of the software for interacting with servers via cURL is related to the possibility of using memory after it is freed. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

The vulnerability of Google Chrome’s WebSockets component allows attackers to circumvent security restrictions.

The vulnerability of Google Chrome’s WebSockets component is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to bypass security restrictions...

The vulnerability of the _traverseJSON() function in the ORM library Sequelize allows a hacker to execute arbitrary SQL code.

The vulnerability of the traverseJSON function in the ORM library Sequelize is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary SQL code...

ROS-20260410-73-0002

A vulnerability in the Node.js software platform involves cross-boundary critical data deletion errors. Exploitation of the vulnerability could allow an attacker acting remotely to impact the confidentiality and integrity of protected information...