CVE-2026-92949

A flaw was found in vm2, a JavaScript sandbox. This vulnerability allows sandboxed scripts to bypass security protections, specifically vm.freeze and vm.readonly, which are designed to prevent unauthorized modifications to objects. An attacker can exploit this by directly accessing and invoking...

firewalld security update

An update is available for firewalld. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list firewalld is a firewall service daemon that provides a dynamic customizable...

RLSA-2026:67585 Moderate: firewalld security update

firewalld is a firewall service daemon that provides a dynamic customizable firewall with a D-Bus interface. Security Fixes: firewalld: firewalld: Local unprivileged user can modify firewall state due to D-Bus setter mis-authorization CVE-2026-4948 For more details about the security issues,...

MiracleLinux 9 : firewalld-1.3.4-20.el9_8 (AXSA:2026-1864:05)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1864:05 advisory. firewalld: firewalld: Local unprivileged user can modify firewall state due to D-Bus setter mis- authorization CVE-2026-4948 Tenable has extracted the...

Moderate: Red Hat Security Advisory: firewalld security update

An update for firewalld is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...

RHEL 10 : firewalld (RHSA-2026:67843)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:67843 advisory. firewalld is a firewall service daemon that provides a dynamic customizable firewall with a D-Bus interface. Security Fixes: firewalld: firewalld:...

AlmaLinux 9 : firewalld (ALSA-2026:67585)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:67585 advisory. firewalld: firewalld: Local unprivileged user can modify firewall state due to D-Bus setter mis- authorization CVE-2026-4948 Tenable has extracted the preceding...

ALSA-2026:67585 Moderate: firewalld security update

firewalld is a firewall service daemon that provides a dynamic customizable firewall with a D-Bus interface. Security Fixes: firewalld: firewalld: Local unprivileged user can modify firewall state due to D-Bus setter mis-authorization CVE-2026-4948 For more details about the security issues,...

PT-2026-93199

Netcore NR255-V version 1.5.130703 contains a null pointer dereference vulnerability in the QoS setter CGI handlers filter conn del cgi.c and gre prio set cgi.c due to unchecked atoi results. An attacker can trigger the flaw by supplying crafted input to these handlers, causing a denial of servic...

RHEL 9 : firewalld (RHSA-2026:67585)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:67585 advisory. firewalld is a firewall service daemon that provides a dynamic customizable firewall with a D-Bus interface. Security Fixes: firewalld: firewalld:...

CVE-2026-76865: NULL Pointer Dereference

Netcore NR255-V version 1.5.130703 contains a null pointer dereference vulnerability in the QoS setter CGI handlers filterconndelcgi.c and grepriosetcgi.c due to unchecked atoi results. An attacker can trigger the flaw by supplying crafted input to these handlers, causing a denial of service...

CVE-2026-87877

zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM...

CVE-2026-87877 zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()

zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM...

CVE-2026-85084 Out-of-bounds write in TizenFX MediaBufferBase indexer setter due to missing bounds check

Out-of-bounds Write and Improper Validation of Array Index vulnerability in Samsung Open Source TizenFX Samsung/TizenFX allows Overflow Buffers...

CVE-2026-73061

Scriban before 7.2.2 contains an access-modifier bypass vulnerability in TypedObjectAccessor that allows template code to write CLR object properties without setter-visibility checks. Attackers can modify properties with private, internal, or init-only setters, and perform mass assignment on...

CVE-2026-73061

Scriban before 7.2.2 contains an access-modifier bypass vulnerability in TypedObjectAccessor that allows template code to write CLR object properties without setter-visibility checks. Attackers can modify properties with private, internal, or init-only setters, and perform mass assignment on...

CVE-2026-72749

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields Set node. The node assigns output fields via a dot-notation path setter without restricting the field name, allowing an authenticated user to name a field after an inherited built-in method pat...

CVE-2026-72749 n8n before 1.123.67 Prototype Pollution via Edit Fields

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields Set node. The node assigns output fields via a dot-notation path setter without restricting the field name, allowing an authenticated user to name a field after an inherited built-in method pat...

CVE-2026-16729

A flaw was found in undici, where its setCookie function does not fully sanitize cookie attributes. A remote attacker could exploit this by providing specially crafted input to the domain or unparsed fields, leading to the injection of additional cookie attributes. This vulnerability can allow an...

DEBIAN-CVE-2026-64243

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: simple-mux: Fix enum control bounds check simplemuxcontrolput rejects values greater than e-items, but enum control values are zero based. For the two-entry mux used by this driver, valid values are 0 and 1, so valu...