CVE-2026-16313

A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev...

CVE-2026-51267

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

Security update for apache-commons-lang3, google-guice, maven, maven-resolver, xmvn

This update for apache-commons-lang3, google-guice, maven, maven-resolver, xmvn fixes the following issues: apache-commons-lang3 was updated to 3.20.0: New features: Add SystemProperties.getPathString, Supplier Add JavaVersion.JAVA25 Add JavaVersion.JAVA26 Add SystemUtils.ISJAVA25 Add...

CVE-2026-66749

Let's Chat 0.4.0 through 0.4.8 contains a null dereference vulnerability that allows authenticated attackers to crash the server by supplying a valid 24-character hex string room parameter that matches no document in the database. Attackers can send a crafted GET /messages request causing an...

binutils: GNU Binutils: Memory corruption via local manipulation of ELF String Table

A flaw was found in GNU Binutils. This vulnerability allows a local attacker to cause memory corruption by manipulating the ELF String Table component, specifically through the bfdelfstrtabdelref function. This could lead to unexpected behavior or system instability...

CVE-2026-54696

A flaw was found in Ruby JSON. A remote attacker could exploit a heap buffer overflow vulnerability by providing an oversized streamed object containing a specially crafted string. This could lead to a reliable process crash, resulting in a denial of service DoS for the affected system...

CVE-2026-67174 DOM-Based Cross-Site Scripting via Unsafe String and SVG Icon Rendering in Pivotick

Pivotick contains a DOM-based cross-site scripting vulnerability in its generic UI element resolution and icon-rendering utilities. The tryResolveHTMLElement function treated any resolved string as HTML markup by assigning it to a element through innerHTML. Strings derived from untrusted graph...

CVE-2026-67174 DOM-Based Cross-Site Scripting via Unsafe String and SVG Icon Rendering in Pivotick

Pivotick contains a DOM-based cross-site scripting vulnerability in its generic UI element resolution and icon-rendering utilities. The tryResolveHTMLElement function treated any resolved string as HTML markup by assigning it to a element through innerHTML. Strings derived from untrusted graph...

CVE-2026-67174

Pivotick is affected by a DOM-based XSS in its generic UI element resolution and icon rendering utilities. The tryResolveHTMLElement function assigns resolved strings to a template via innerHTML, allowing untrusted graph properties or rendering callbacks to inject arbitrary HTML/SVG into the live...

Malicious Package

Overview string-format-kit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Security update for glib2

This update for glib2 fixes the following issues: CVE-2026-58010: error during gvstupleisnormal alignment validation could cause a 1-byte out-of-bounds read bsc1270009. CVE-2026-58011: invalid GDateTime in gdatetimegetymd could trigger a 2-byte out-of-bounds read bsc1270010. CVE-2026-58012: raw...

SUSE-SU-2026:3341-1 Security update for glib2

This update for glib2 fixes the following issues: - CVE-2026-58010: error during gvstupleisnormal alignment validation could cause a 1-byte out-of-bounds read bsc1270009. - CVE-2026-58011: invalid GDateTime in gdatetimegetymd could trigger a 2-byte out-of-bounds read bsc1270010. - CVE-2026-58012:...

BIT-THRIFT-2026-58389 Apache Thrift: Rust binary protocol non-strict path missing string size limit

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Rust bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

SUSE-SU-2026:22997-1 Security update for hawk-apiserver

This update for hawk-apiserver fixes the following issues: Changes in hawk-apiserver: - Bump ClusterLabs/go-pacemaker v0.0.0-20260609131737-256130b189e0 bsc1267454 Version 0.1.0+git.1773234993.db3c82f: handle /cib/live/primitives//edit in hawk-apiserver - Bump github.com/stretchr/testify.v1.11.0...

MAL-2026-11108 Malicious code in string-format-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e41e5ec29fcbb379f86d5a6167b42aec242fede681343996c198b1430e2dffa The package's postinstall.js lifecycle script executes a shell pipeline via childprocess.exec on npm install. The pipeline reads /.ssh/idrsa,...

Malicious code in string-format-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e41e5ec29fcbb379f86d5a6167b42aec242fede681343996c198b1430e2dffa The package's postinstall.js lifecycle script executes a shell pipeline via childprocess.exec on npm install. The pipeline reads /.ssh/idrsa,...

EUVD-2026-49639

An issue in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the str parameter of the filemanagecontrol.php component...

CVE-2026-51267

CVE-2026-51267 entry is rejected/not used; not a security issue.

EUVD-2026-49865

schreibfaul1 ESP32-audioI2S 3.4.5 has a heap-based buffer overflow vulnerability in the URL path concatenation and encoding module. The application splices untrusted extension path and attacker-controlled query string into a path buffer, then invokes urlencode without validating the final string...

PT-2026-65506

schreibfaul1 ESP32-audioI2S 3.4.5 is vulnerable to Buffer Overflow. The Audio::openai speech function in the Audio library manually constructs JSON request bodies and HTTP request headers by directly concatenating externally controllable input and instructions strings without effective length...