6988 matches found
GPU components DoS
The vulnerability of the GPU components in Google Chrome and Microsoft Edge relates to reading data from buffer areas beyond their acceptable limits. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...
GPU components Confidential Data Access
The vulnerability of the GPU components in Google Chrome and Microsoft Edge relates to reading data from buffer areas beyond their permitted limits. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...
GPU components DoS
The vulnerability of the GPU components in Google Chrome and Microsoft Edge relates to buffer overflow attacks. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially crafted HTML page...
CVE-2026-70598
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3, offscreen rendering frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could...
NPM: Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size
NPM: Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size vulnerability discovered by ? in WordPress Npm electron versions 39.8.10...
Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size
Impact In offscreen rendering mode, frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing paint event images, disclosing memory or crashing the app. Apps are only...
GHSA-PFMC-3MGC-P6FP Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size
Impact In offscreen rendering mode, frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing paint event images, disclosing memory or crashing the app. Apps are only...
EUVD-2026-53420
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3, offscreen rendering frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could...
CVE-2026-70598 Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3, offscreen rendering frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could...
CVE-2026-70598
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3, offscreen rendering frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could...
CVE-2026-70598 Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3, offscreen rendering frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could...
python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations
A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit CPU resources. This leads to...
Malicious code in json-validator-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 255dbc17164a6243a92bab0b4d71132efad3028b53e73d7d2924a1d7ccd1e8cf The package advertises itself as a JSON/XML validator but lib/core.js contains a multi-stage dropper triggered on any call to the public API...
MAL-2026-12000 Malicious code in streak-math-metrics (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3769541ab9576413a88f4e32ef21b55090b7efc17fd44750269f9e19e854abb1 The package's module entry dist/index.mjs runs a top-level IIFE on import that chmods dist/math-calc.bin to 0755 and spawns it detached...
CVE-2026-67873
A heap-based buffer overflow exists in lib60870-C 2.4.0 in the server-side FileSegment ASDU encoding path. The issue occurs because FileSegmentencode validates only the standalone segment length via FileSegmentGetMaxDataSize and does not verify the residual capacity of the current ASDU frame befo...
CVE-2026-67873
A heap-based buffer overflow exists in lib60870-C 2.4.0 in the server-side FileSegment ASDU encoding path. The issue occurs because FileSegmentencode validates only the standalone segment length via FileSegmentGetMaxDataSize and does not verify the residual capacity of the current ASDU frame befo...
MAL-2026-11539 Malicious code in entropyeasybots (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82e7d0cd2ef4870fdc4484c815737ade78e04bdac4843df02f5cf876cfa3dbaa index.js decodes a base64-obfuscated IP 85.137.253.124 and connects a spawned /bin/sh subprocess's stdio to a TCP socket at 85.137.253.124:1111,...
CVE-2026-0163
A use-after-free vulnerability exists in multiple functions of the vpu_ioctl.c file within the Video Processing Unit (VPU) driver on Android. The flaw occurs when the driver retrieves a driver instance from an array and resets the reference counter before closing it, leading to memory being used ...
MAL-2026-11947 Malicious code in @servicetitan/unit-tests (npm)
npm/@servicetitan/unit-tests is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
