390 matches found
CVE-2020-28502
CVE-2020-28502 node-XMLHttpRequest RCE NVD-Beschreibung Dies betrifft das Paket xmlhttprequest vor 1.7.0 sowie alle Versionen des Pakets xmlhttprequest-ssl. Sofern Anfragen synchron gesendet werden async=False bei xhr.open, kann schädliche Benutzereingabe, die in xhr.send fließt, dazu führen, das...
CVE-2026-80346
StarRocks performs no privilege check when a legacy synchronous materialized view is dropped. Every other statement type routed through AuthorizerStmtVisitor calls into Authorizer before execution, but visitDropMaterializedViewStatement returns immediately with a comment stating the check happens...
CVE-2026-80346
StarRocks through 4.0.13 has a missing authorization vulnerability in the DROP MATERIALIZED VIEW code path for legacy synchronous materialized views. When such a view is dropped, the statement visitor returns without invoking the Authorizer , and the execution logic that should perform the check ...
CVE-2026-80346 StarRocks through 4.0.13 Missing Authorization on DROP MATERIALIZED VIEW for Legacy Synchronous Materialized Views
StarRocks performs no privilege check when a legacy synchronous materialized view is dropped. Every other statement type routed through AuthorizerStmtVisitor calls into Authorizer before execution, but visitDropMaterializedViewStatement returns immediately with a comment stating the check happens...
alpr-dashboard-patches
Patch di runtime per ALPR Dashboard Due patch drop-in per il progetto Docker algertc/alpr-dashboard. Entrambe sono distribuibili senza modificare o ricostruire l'immagine upstream. Cosa c'è qui logger-fix/ — logger asincrono + throttle della pulizia Sostituisce il trasporto di log sincrono...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerabilities have been resolved: ACPI: APEI: Send SIGBUS to the current task if a synchronous memory error is not recovered. If a synchronous error is detected due to a user-space process triggering a 2-bit uncorrected error, the CPU will raise an exception,...
BIT-NODE-2026-58045
A flaw in Node.js allows a spoofed TypedArray byteLength to trigger a reachable assertion in the synchronous node:zlib APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected. Repeated exploitation of this condition can result in a denial of service. This...
PT-2026-73413
A flaw in Node.js allows a spoofed TypedArray byteLength to trigger a reachable assertion in the synchronous node:zlib APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected. Repeated exploitation of this condition can result in a denial of service. This...
CVE-2026-74578
In the Linux kernel, the following vulnerability has been resolved: crypto: algifskcipher - force synchronous processing on trees without ctx-state The AIO/async path in skcipherrecvmsg passes the socket-wide ctx-iv directly into the skcipher request. After iosubmit the socket lock is dropped and...
Linux Distros Unpatched Vulnerability : CVE-2026-48802
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - python-engineio is a Python implementation of the Engine.IO realtime client and server. Prior to version 4.13.2, an attacker can cause the creation of unnecessa...
CVE-2026-48802
python-engineio is a Python implementation of the Engine.IO realtime client and server. Prior to version 4.13.2, an attacker can cause the creation of unnecessary background threads in the python-engineio server by exploiting the heartbeat mechanism, which launches a thread when a new connection ...
DEBIAN-CVE-2026-48802
python-engineio is a Python implementation of the Engine.IO realtime client and server. Prior to version 4.13.2, an attacker can cause the creation of unnecessary background threads in the python-engineio server by exploiting the heartbeat mechanism, which launches a thread when a new connection ...
UBUNTU-CVE-2026-48802
python-engineio is a Python implementation of the Engine.IO realtime client and server. Prior to version 4.13.2, an attacker can cause the creation of unnecessary background threads in the python-engineio server by exploiting the heartbeat mechanism, which launches a thread when a new connection ...
EUVD-2026-56859
python-engineio is a Python implementation of the Engine.IO realtime client and server. Prior to version 4.13.2, an attacker can cause the creation of unnecessary background threads in the python-engineio server by exploiting the heartbeat mechanism, which launches a thread when a new connection ...
CVE-2026-48802 python-engineio has unbound thread allocation that can cause denial of service
python-engineio is a Python implementation of the Engine.IO realtime client and server. Prior to version 4.13.2, an attacker can cause the creation of unnecessary background threads in the python-engineio server by exploiting the heartbeat mechanism, which launches a thread when a new connection ...
CVE-2026-48802
Summary (CVE-2026-48802, python-engineio): Before v4.13.2, a heartbeat-driven background thread could be created on new connections or PONG handling, causing DoS especially on synchronous servers. The fix in v4.13.2 changes the behavior so that the initial heartbeat background thread/async task i...
CVE-2026-48802
python-engineio is a Python implementation of the Engine.IO realtime client and server. Prior to version 4.13.2, an attacker can cause the creation of unnecessary background threads in the python-engineio server by exploiting the heartbeat mechanism, which launches a thread when a new connection ...
CVE-2026-48802
python-engineio is a Python implementation of the Engine.IO realtime client and server. Prior to version 4.13.2, an attacker can cause the creation of unnecessary background threads in the python-engineio server by exploiting the heartbeat mechanism, which launches a thread when a new connection ...
nodejs: Node.js: Denial of Service vulnerability
A flaw was found in Node.js. A malicious actor could exploit this vulnerability by providing a specially crafted input to the synchronous node:zlib APIs. This could cause the Node.js process to crash, leading to a denial of service and making the application unavailable to users...
CVE-2026-58045
A flaw was found in Node.js. A malicious actor could exploit this vulnerability by providing a specially crafted input to the synchronous node:zlib APIs. This could cause the Node.js process to crash, leading to a denial of service and making the application unavailable to users. Mitigation...