CVE-2022-2274

Corrupción de Memoria Heap en OpenSSL-src con Operación de Clave Privada RSA : CVE-2022-2274 Resumen OpenSSL-src-rust es un código fuente y lógica para compilar OpenSSL desde el código fuente escrito en Rust y empaquetado como una crate. Actualmente hay dos ramas mantenidas, que corresponden a la...

CVE-2026-89240

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Live/confirmLivePassword.php. The script interpolates the unauthenticated GET parameter u which is not covered by $securityFilter directly into an attribute withou...

Serein

Serein | En el atardecer de lluvia | Este proyecto está en pausa Linux English version is online! | ¡Ya está disponible la versión en inglés de Linux! http://github.com/W01fh4cker/SereinLinux Declaration | Declaración Este proyecto está destinado solo para uso autorizado. Prohibido su uso para...

CVE-2026-79522

An out-of-bounds read in the gfdmgetchunkdata function src/utils/...

UBUNTU-CVE-2026-79522

An out-of-bounds read in the gfdmgetchunkdata function src/utils/...

CVE-2026-87812

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in Bazaar package cards where the iconURL metadata is inserted directly into HTML img src attributes without escaping. Attackers can inject malicious URLs with event handlers that execute JavaScript in the authenticated...

CVE-2026-84857

A flaw has been found in sigoden aichat up to 0.30.4. This affects an unknown function of the file src/serve.rs of the component API Endpoint. This manipulation causes uncontrolled memory allocation. The attack can be initiated remotely. The exploit has been published and may be used. The vendor...

EUVD-2026-70279

A flaw has been found in sigoden aichat up to 0.30.4. This affects an unknown function of the file src/serve.rs of the component API Endpoint. This manipulation causes uncontrolled memory allocation. The attack can be initiated remotely. The exploit has been published and may be used. The vendor...

CVE-2026-82112

A path traversal vulnerability exists in the houtini-ai/houtini-lm project (versions up to 2.13.2 ), specifically in the code_task_files component within src/index.ts . A remote attacker with low privileges and user interaction can manipulate an unknown function to read files outside the intended...

CVE-2026-82112 houtini-ai houtini-lm code_task_files index.ts path traversal

A flaw has been found in houtini-ai houtini-lm up to 2.13.2. The impacted element is an unknown function of the file src/index.ts of the component codetaskfiles. Executing a manipulation can lead to path traversal. The attack can be launched remotely. This patch is called...

CVE-2026-81491 boxpositron with-context-mcp index.ts project_folder path traversal

A flaw has been found in boxpositron with-context-mcp up to 3.0.7. This affects the function ingestnotes/teleportnotes/syncnotes/projectfolder of the file src/index.ts. Executing a manipulation can lead to path traversal. It is possible to launch the attack remotely. The exploit has been publishe...

EUVD-2026-66835

A flaw has been found in boxpositron with-context-mcp up to 3.0.7. This affects the function ingestnotes/teleportnotes/syncnotes/projectfolder of the file src/index.ts. Executing a manipulation can lead to path traversal. It is possible to launch the attack remotely. The exploit has been publishe...

CVE-2026-74737

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw-nuss: Fix portid extraction from SRC TAG On the packet reception path, the ID of the MAC Port on which the packet was received, is embedded in the RX DMA Descriptor's metadata. The ID is extracted usi...

UBUNTU-CVE-2026-74737

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw-nuss: Fix portid extraction from SRC TAG On the packet reception path, the ID of the MAC Port on which the packet was received, is embedded in the RX DMA Descriptor's metadata. The ID is extracted usi...

CVE-2026-78637

A vulnerability was detected in Fdawgs node-poppler up to 9.1.2/10.0.1. The impacted element is the function pdfInfo/pdfToText/pdfToCairo/pdfToPpm/pdfImages/pdfToHtml/pdfToPs/pdfFonts/pdfDetach/pdfAttach/pdfSeparate/pdfUnite of the file src/index.js of the component Argument Injection Handler...

CVE-2026-78637 Fdawgs node-poppler Argument Injection index.js pdfUnite argument injection

A vulnerability was detected in Fdawgs node-poppler up to 9.1.2/10.0.1. The impacted element is the function pdfInfo/pdfToText/pdfToCairo/pdfToPpm/pdfImages/pdfToHtml/pdfToPs/pdfFonts/pdfDetach/pdfAttach/pdfSeparate/pdfUnite of the file src/index.js of the component Argument Injection Handler...

EUVD-2026-65293

A vulnerability was detected in Fdawgs node-poppler up to 9.1.2/10.0.1. The impacted element is the function pdfInfo/pdfToText/pdfToCairo/pdfToPpm/pdfImages/pdfToHtml/pdfToPs/pdfFonts/pdfDetach/pdfAttach/pdfSeparate/pdfUnite of the file src/index.js of the component Argument Injection Handler...

Astra Linux – Vulnerability in Thunderbird, Firefox

A poorly handled security check during the creation of a WebSocket in a WebWorker caused the Content Security Policy’s connect-src header to be ignored. This could lead to connections being made to restricted origins from within WebWorkers. This vulnerability affects Firefox 109, Firefox ESR 102....

Astra Linux – Vulnerability in Firefox

An attacker was able to bypass the connect-src directive of a Content Security Policy by manipulating subdocuments. This would have also hidden the connections from the Network tab in Devtools. This vulnerability was fixed in Firefox 140 and Thunderbird 140...

Astra Linux – Vulnerability in Qemu

A flaw was discovered in the QEMU virtual crypto device during handling of data encryption/decryption requests in virtiocryptohandlesymreq. There is no check for the values of srclen and dstlen in virtiocryptosymophelper, which may lead to a heap buffer overflow if these values differ...