58 matches found
CVE-2026-71438
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid's configuration setters mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig merge caller-supplied configuration into Mermaid's interna...
DEBIAN-CVE-2026-71438
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid's configuration setters mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig merge caller-supplied configuration into Mermaid's interna...
CVE-2026-71438
Mermaid (JavaScript) prior to versions 10.9.8 and 11.16.1 is vulnerable to prototype pollution via its configuration entry points mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig, which merge caller-supplied data into internal config using the assignWithDepth deep-merge h...
CVE-2026-71438
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid's configuration setters mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig merge caller-supplied configuration into Mermaid's interna...
NPM: Electron: contextBridge object copy honors prototype setters
NPM: Electron: contextBridge object copy honors prototype setters vulnerability discovered by ? in WordPress Npm electron versions 39.8.9...
EulerOS 2.0 SP12 : firewalld (EulerOS-SA-2026-2587)
According to the versions of the firewalld packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis-authorizing two runtime D-Bus Desktop Bus setter...
EulerOS 2.0 SP15 : firewalld (EulerOS-SA-2026-2440)
According to the versions of the firewalld packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis-authorizing two runtime D-Bus Desktop Bus setter...
Improperly Controlled Modification of Dynamically-Determined Object Attributes
Overview Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in the POJOPropertiesCollector.renameProperties and BeanDeserializerFactory.addBeanProps methods, which rename rather than drop a property whose getter carri...
CVE-2026-54516 jackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fields
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, POJOPropertiesCollector.renameProperties allows a property with @JsonProperty"renamed" on the getter and @JsonIgnore on the setter to be renamed...
firewalld: firewalld: Local unprivileged user can modify firewall state due to D-Bus setter mis-authorization
A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis-authorizing two runtime D-Bus Desktop Bus setters, setZoneSettings2 and setPolicySettings. This mis-authorization allows the user to modify the runtime firewall state without proper authentication,...
EulerOS 2.0 SP13 : firewalld (EulerOS-SA-2026-2286)
According to the versions of the firewalld packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis-authorizing two runtime D-Bus Desktop Bus setter...
EulerOS 2.0 SP11 : firewalld (EulerOS-SA-2026-2202)
According to the versions of the firewalld packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis-authorizing two runtime D-Bus Desktop Bus setter...
EulerOS 2.0 SP11 : firewalld (EulerOS-SA-2026-2240)
According to the versions of the firewalld packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis-authorizing two runtime D-Bus Desktop Bus setter...
CVE-2026-46154
A flaw was found in the Linux kernel, specifically within the schedext component. This vulnerability, a use-after-free, occurs in the cgroup setters when the scxroot pointer is cached before a required lock is acquired. This can lead to a stale pointer if a scheduler is disabled and then...
CVE-2026-46154
In the Linux kernel, the following vulnerability has been resolved: schedext: Read scxroot under scxcgroupopsrwsem in cgroup setters scxgroupsetweight,idle,bandwidth cache scxroot before acquiring scxcgroupopsrwsem, so the pointer can be stale by the time the op runs. If the loaded scheduler is...
CVE-2026-46154
CVE-2026-46154 affects the Linux kernel sched_ext functionality. Root cause: in cgroup setters, scx_group_set_{weight,idle,bandwidth}() cache the scx_root before acquiring scx_cgroup_ops_rwsem, enabling a window where the pointer can become stale if a scheduler is disabled and freed (via RCU) and...
CVE-2026-46154 sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters
In the Linux kernel, the following vulnerability has been resolved: schedext: Read scxroot under scxcgroupopsrwsem in cgroup setters scxgroupsetweight,idle,bandwidth cache scxroot before acquiring scxcgroupopsrwsem, so the pointer can be stale by the time the op runs. If the loaded scheduler is...
CVE-2026-46154
In the Linux kernel, the following vulnerability has been resolved: schedext: Read scxroot under scxcgroupopsrwsem in cgroup setters scxgroupsetweight,idle,bandwidth cache scxroot before acquiring scxcgroupopsrwsem, so the pointer can be stale by the time the op runs. If the loaded scheduler is...
CVE-2026-46154 sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters
In the Linux kernel, the following vulnerability has been resolved: schedext: Read scxroot under scxcgroupopsrwsem in cgroup setters scxgroupsetweight,idle,bandwidth cache scxroot before acquiring scxcgroupopsrwsem, so the pointer can be stale by the time the op runs. If the loaded scheduler is...
CLSA-2026-1779127797 libpng15: Fix of CVE-2026-34757
CVE-2026-34757: Use snapshot-before-free and defer-free patterns to prevent use-after-free when a caller passes a pointer obtained from pnggetPLTE, pnggettRNS, pnggethIST, pnggettext, pnggetsPLT, or pnggetunknownchunks back into the corresponding setter issues 836 and 837...