30933 matches found
CVE-2026-46681
CVE-2026-46681 affects the npm package @nevware21/ts-utils. Prior to version 0.14.0, the internal _copyProps function in lib/src/object/copy.ts iterates over source properties with for...in without an Object.hasOwnProperty check and does not filter dangerous keys (proto , constructor, prototype)....
ROOT-APP-NPM-GHSA-2CM2-M3W5-GP2F GHSA-2cm2-m3w5-gp2f in @rootio/vm2 - Patched by Root
Root has patched GHSA-2cm2-m3w5-gp2f in the @rootio/vm2 package for Root:npm. Multiple fixed versions available...
ROOT-OS-DEBIAN-11-CVE-2026-6653 CVE-2026-6653 in rootio-libxml2 - Patched by Root
Root has patched CVE-2026-6653 in the rootio-libxml2 package for Root:Debian:11. Multiple fixed versions available...
[SECURITY] Fedora 43 Update: libtiff-4.7.2-1.fc43
The libtiff package contains a library of functions for manipulating TIFF Tagged Image File Format image format files. TIFF is a widely used file format for bitmapped images. TIFF files usually end in the .tif extension and they are often quite large. The libtiff package should be installed if yo...
CVE-2026-47128
nono is software that allows users to run AI agents in a zero-latency sandbox. Prior to version 0.55.0, the nono Landlock/seccomp policies allow access to local Unix domain sockets concrete and abstract. This allows an easy sandbox escape by talking to the per-user systemd dbus socket. Version...
Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)
Summary When Composer is run with -vvv debug verbosity, it could print a credential that was embedded directly in a repository or package URL, but not as a password, to its debug output. Composer already masked the password portion of such URLs, but the username portion was shown in clear text...
CVE-2026-32824
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, a low-privileged authenticated API user can supply forwardToUrl and...
Security update for sssd
This update for sssd fixes the following issues CVE-2026-14474: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation bsc1270709. CVE-2026-14476: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypas...
ROOT-APP-NPM-CVE-2026-1527 CVE-2026-1527 in @rootio/undici - Patched by Root
Root has patched CVE-2026-1527 in the @rootio/undici package for Root:npm. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-49476 CVE-2026-49476 in rootio-soupsieve - Patched by Root
Root has patched CVE-2026-49476 in the rootio-soupsieve package for Root:PyPI. Multiple fixed versions available...
ROOT-OS-DEBIAN-13-CVE-2026-33165 CVE-2026-33165 in rootio-libde265 - Patched by Root
Root has patched CVE-2026-33165 in the rootio-libde265 package for Root:Debian:13. Multiple fixed versions available...
CVE-2026-63982
In the Linux kernel, the following vulnerability has been resolved: n...
CVE-2026-64018
In the Linux kernel, the following vulnerability has been resolved: n...
CVE-2026-53394
In the Linux kernel, the following vulnerability has been resolved: n...
UBUNTU-CVE-2026-64135
In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/adm1266 widen blackbox-info buffer to I2CSMBUSBLOCKMAX adm1266nvmemreadblackbox declares a 5-byte stack buffer and passes it to i2csmbusreadblockdata to retrieve the 4-byte BLACKBOXINFO response. i2csmbusreadblockdat...
UBUNTU-CVE-2026-63986
In the Linux kernel, the following vulnerability has been resolved: ethtool: tsinfo: don't pass ERRPTR to genlmsgcancel on prepare failure The goto err label leads to: genlmsgcancelskb, ehdr; return ret; If ethnltsinfopreparedump failed, it has not started a genlmsg. There's nothing to cancel, an...
UBUNTU-CVE-2026-63988
In the Linux kernel, the following vulnerability has been resolved: bridge: Fix sleep in atomic context in sysfs path Since the start of the git history, brportstore always acquired the bridge lock. Back then this decision made sense: The bridge lock protects the STP state of the bridge and its...
UBUNTU-CVE-2026-63906
In the Linux kernel, the following vulnerability has been resolved: usb: musb: omap2430: Fix use-after-free in omap2430probe In omap2430probe, ofnodeputnp is called prematurely before the last access to np, leading to a use-after-free if the node's reference count drops to zero. Move the ofnodepu...
UBUNTU-CVE-2026-63994
In the Linux kernel, the following vulnerability has been resolved: tunnels: load network headers after skbcow in iptunnelpmtudbuildicmpv6 Sashiko found that iptunnelpmtudbuildicmp and iptunnelpmtudbuildicmpv6 were caching iphdr and ipv6hdr before an skbcow call which can reallocate skb-head. Fix...