7006 matches found
HP Device Manager Vulnerability Update (5.0.16)
Potential vulnerabilities have been identified in HP Device Manager versions prior to HPDM 5.0.16. HP is releasing mitigation for the potential vulnerabilities as part of the 5.0.16 release. All of the identified vulnerabilities listed above were addressed and fixed as part of HP Device Manager...
PT-2026-24059
Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permission to read-only wrapped user-mode memory. This is caused by improper handling of the memory protections for the user-mode wrapped memory resource...
Google Android Information Disclosure Vulnerability (CNVD-2026-16154)
Google Android is a Linux-based open source operating system from Google. Google Android suffers from an information disclosure vulnerability. The vulnerability is caused by a possible way to access the GPU cache due to side channel information leakage in drawLayersInternal of SkiaRenderEngine.cp...
ffmpeg:ffmpeg_AV_CODEC_ID_VVC_fuzzer: Heap-buffer-overflow in cbs_h266_read_pps
Project: https://git.ffmpeg.org/ffmpeg.git https://github.com/FFmpeg/FFmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=4711353817563136 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDVVCfuzzer Job Type: libfuzzerasani386ffmpeg Platform Id: linux Crash Type:...
Linux KVM MMU Buffer Overflow DoS
The vulnerability in the arch/x86/kvm/mmu.c module of the virtualization subsystem on the Linux kernel-based x86 platform is related to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality,...
ivpu_pm Heap Buffer Overflow DoS
Vulnerability of the ivpupminit function in the drivers/accel/ivpu/ivpupm.c module – The Linux NPU processor driver has vulnerabilities related to state management. Exploiting this vulnerability could allow an attacker to cause a system failure...
GNU Binutils objdump security vulnerability
GNU Binutils objdump is a command-line tool for binary files in the American GNU community. GNU Binutils objdump has a security vulnerability, which stems from an error in the processing logic of the DWARF compilation unit when dealing with specially crafted binary files. This error may lead to t...
GStreamer H.266 Codec Parser Stack-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of decoding...
PT-2026-29485
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.0.0-rc2-eafebd2d2ab0-sink-vm 319 Description The Linux kernel contains a flaw within the KVM component related to memory management. Specifically, the issue involves an incorrect sanity check when overwriting a...
PT-2026-51776
Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.0.13 Description The software uses bcrypt with a default salt round value of 5, resulting in only 32 iterations. This is significantly lower than the OWASP-recommended minimum of 10 rounds 1024 iterations. This...
Medium: assertj-core
Issue Overview: AssertJ provides Fluent testing assertions for Java and the Java Virtual Machine JVM. Starting in version 1.4.0 and prior to version 3.27.7, an XML External Entity XXE vulnerability exists in org.assertj.core.util.xml.XmlStringPrettyFormatter: the toXmlDocumentString method...
Challenges and Design Considerations for Finding CUDA Bugs through GPU-Native Fuzzing
Modern computing is shifting from homogeneous CPU-centric systems to heterogeneous systems with closely integrated CPUs and GPUs. While the CPU software stack has benefited from decades of memory safety hardening, the GPU software stack remains dangerously immature. This discrepancy presents a...
org.apache.activemq:activemq-http (>=6.0.0, <=6.1.8), org.apache.activemq:activemq-karaf (>=6.0.0, <=6.1.8) +4 more potentially affected by CVE-2025-66168 via org.apache.activemq:activemq-mqtt (>=6.0.0, <=6.1.8)
org.apache.activemq:activemq-mqtt MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.1.8 Source cves: CVE-2025-66168 Source advisory: GHSA-C825-6PH3-4H84...
org.apache.activemq:activemq-http (>=6.0.0, <=6.1.8), org.apache.activemq:activemq-karaf (>=6.0.0, <=6.1.8) +4 more potentially affected by CVE-2025-66168 via org.apache.activemq:activemq-mqtt (>=6.0.0, <=6.1.8)
org.apache.activemq:activemq-mqtt MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.1.8 Source cves: CVE-2025-66168 Source advisory: OSV:GHSA-C825-6PH3-4H84...
CVE-2026-28399
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter. This issue has been patched in version 0.301.3...
OpenClaw Improperly Neutralizes Line Breaks in systemd Unit Generation Enables Local Command Execution (Linux)
Summary A command injection vulnerability exists in OpenClaw’s Linux systemd unit generation path. When rendering Environment= entries, attacker-controlled values are not rejected for CR/LF, and systemdEscapeArg uses an incorrect whitespace-matching regex. This allows newline injection to break o...
GHSA-VFFC-F7R7-RX2W OpenClaw Improperly Neutralizes Line Breaks in systemd Unit Generation Enables Local Command Execution (Linux)
Summary A command injection vulnerability exists in OpenClaw’s Linux systemd unit generation path. When rendering Environment= entries, attacker-controlled values are not rejected for CR/LF, and systemdEscapeArg uses an incorrect whitespace-matching regex. This allows newline injection to break o...
GHSA-45RP-9P97-H852 NocoDB Vulnerable to SQL Injection via DATEADD Formula
Summary An authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter. Details The third argument unit of DATEADD was interpolated directly into knex.raw queries after only stripping quote characters. Validation in formulas.ts only checked Literal AST...
NocoDB Vulnerable to SQL Injection via DATEADD Formula
Summary An authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter. Details The third argument unit of DATEADD was interpolated directly into knex.raw queries after only stripping quote characters. Validation in formulas.ts only checked Literal AST...
