79772 matches found
CVE-2026-107846
bitcoinjs-lib is a JavaScript Bitcoin library for Node.js and browsers. From 2.3.0 until 5.2.1, 6.1.8, and 7.0.2, fastMerkleRoot pads odd Merkle-tree levels by hashing the final node with itself but does not report adjacent duplicate hashes. The affected block-root verifier was introduced as...
CVE-2026-107846 bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list
bitcoinjs-lib is a JavaScript Bitcoin library for Node.js and browsers. From 2.3.0 until 5.2.1, 6.1.8, and 7.0.2, fastMerkleRoot pads odd Merkle-tree levels by hashing the final node with itself but does not report adjacent duplicate hashes. The affected block-root verifier was introduced as...
CVE-2026-107846
The bitcoinjs-lib JavaScript library (versions 2.3.0 until 5.2.1, 6.1.8, and 7.0.2) contains a vulnerability in the fastMerkleRoot function. The root cause is that the function pads odd Merkle-tree levels by hashing the final node with itself without reporting adjacent duplicate hashes. This allo...
EUVD-2026-117015
On Yealink UVC40 E2 devices before 319.410.0.71, an attacker with short-term physical access can steal Wi‑Fi credentials via the USB interface. Sensitive data within the firmware configuration can be abused to gain root privileges on the device. Within Wi‑Fi coverage, the attacker may perform aud...
CVE-2026-122124
The Yealink UVC40 E2 devices running firmware versions before 319.410.0.71 are vulnerable to a security flaw where an attacker with short-term physical access can use the USB interface to steal Wi‑Fi credentials . Furthermore, sensitive data within the firmware configuration can be exploited to g...
CVE-2026-109518
On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic including a malicious mirror or proxy between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified...
DEBIAN-CVE-2026-109518
On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic including a malicious mirror or proxy between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified...
CVE-2026-109518
On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic including a malicious mirror or proxy between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified...
CVE-2026-109518 APT RCE via hard link reuse
On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic including a malicious mirror or proxy between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified...
CVE-2026-109518
An on-path attacker capable of manipulating HTTP traffic can exploit a hard link reuse vulnerability in the APT client on Debian, Ubuntu, and derivative Linux distributions . By tricking the client into following redirects and retrying downloads, an attacker can force the installation of an unver...
EUVD-2026-116969
On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic including a malicious mirror or proxy between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified...
CVE-2026-109518
On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic including a malicious mirror or proxy between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified...
CVE-2026-39431
On HP Poly EagleEye Cube USB 1.3.1-001267 devices, one of the API functions available on a management service accessible via USB allows command injection. This allows attackers without administrator-level access to execute arbitrary commands on the device as root. This is due to insufficient inpu...
Exploit for Write-what-where Condition in Linux Linux_Kernel
One-click Jailbreak for iQOO Neo8 V2301A / PD2301 On the...
CVE-2026-109518
On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic including a malicious mirror or proxy between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified...
ROOT-OS-DEBIAN-13-CVE-2025-11021 CVE-2025-11021 in libsoup3 - Patched by Root
Root has patched CVE-2025-11021 in the libsoup3 package for Root:Debian:13. Multiple fixed versions available...
ROOT-OS-DEBIAN-13-CVE-2026-3099 CVE-2026-3099 in libsoup3 - Patched by Root
Root has patched CVE-2026-3099 in the libsoup3 package for Root:Debian:13. Multiple fixed versions available...
ROOT-OS-DEBIAN-13-CVE-2026-85197 CVE-2026-85197 in libsoup3 - Patched by Root
Root has patched CVE-2026-85197 in the libsoup3 package for Root:Debian:13. Multiple fixed versions available...