16480 matches found
MAL-2026-6672 Malicious code in ulid-xyz (npm)
ulid-xyz is a typosquat of the popular ulid library sortable unique IDs and is a cross-platform Remote Access Trojan delivered via a postinstall hook. The package.json postinstall superficially looks like an inline node -e guard that checks for the existence of a dist file, but it actually launch...
Linux skbuff Privilege Escalation
The vulnerability of the skbuff network component in Linux operating systems is related to insufficient resource control during its existence. Exploiting this vulnerability can allow attackers to enhance their privileges...
CVE-2026-13757: Uncontrolled Recursion
A flaw was found in p11-kit. The RPC message attribute parsing functions p11rpcmessagegetattribute and p11rpcmessagegetattributearrayvalue form a mutually-recursive call chain with no recursion depth limit when processing nested CKAWRAPTEMPLATE, CKAUNWRAPTEMPLATE, and CKADERIVETEMPLATE attributes...
CVE-2026-10643: Out-of-bounds Write
Zephyr's IP socket recvmsg implementation subsys/net/lib/sockets/socketsinet.c, insertpktinfo validated the user-supplied ancillary msgcontrol buffer using only the payload length msg-msgcontrollen pktinfolen before writing a full control message consisting of an aligned cmsg header plus the...
Linux Distros Unpatched Vulnerability : CVE-2026-53236
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tcp: restrict SOATTACHFILTER to priv users This patch restricts the use of SOATTACHFILTER cBPF on TCP sockets to users with CAPNETADMIN capability. This blocks...
Linux Distros Unpatched Vulnerability : CVE-2026-53256
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: RFCOMM: hold listener socket in rfcommconnectind rfcommgetsockbychannel scans rfcommsklist under the list lock, but returns the selected listener aft...
Linux kernel Heap Buffer Overflow DoS
The vulnerability of the skbsegmentlist function in the net/core/skbuff.c module of the Linux kernel is related to resource exhaustion. Exploiting this vulnerability can allow an attacker to cause a service failure...
Stored DOM-Based Cross-Site Scripting
wwbn/avideo is vulnerable to Stored DOM-Based Cross-Site Scripting. The vulnerability is due to improper validation and sanitization of the attacker-controlled webSocketSelfURI and pagetitle parameters in the YPTSocket plugin, which are stored and later rendered into the DOM using $.append withou...
net: mvpp2: refill RX buffers before XDP or skb use
...
netdevsim: zero initialize struct iphdr in dummy sk_buff
...
bpf, sockmap: Fix af_unix null-ptr-deref in proto update
...
bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path
...
bpf, sockmap: Fix af_unix iter deadlock
...
net: tls: fix strparser anchor skb leak on offload RX setup failure
...
udp: clear skb->dev before running a sockmap verdict
...
net: skbuff: fix missing zerocopy reference in pskb_carve helpers
...
vsock/vmci: fix sk_ack_backlog leak on failed handshake
...
Bluetooth: RFCOMM: validate skb length in MCC handlers
...