LightFTP Server 2.3.1 Race Condition

Summary Small x86-32/x64 FTP Server. Description LightFTP 2.3.1 contains a residual race condition an incomplete fix for CVE-2024-11144 in the workerthreadcleanup function of ftpserv.c. The control thread reads and acts on shared per-connection state, including the worker thread id it then passes...

FreeBSD : Angie -- multiple vulnerabilities (347fe124-8f53-11f1-9f4f-3c7c3fba4204)

"The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 347fe124-8f53-11f1-9f4f-3c7c3fba4204 advisory. The Angie Software Team reports: When evaluating a string expression in which unnamed capture...

PT-2026-67897

Name of the Vulnerable Software and Affected Versions OpenSIPS versions prior to 3.6.6 OpenSIPS versions prior to 4.0.0-rc1 Description A denial of service issue exists in the SDP bandwidth-line parsing logic. An unauthenticated remote attacker can send a SIP request with Content-Type:...

CVE-2026-67607 LightFTP 2.3.1 Race Condition DoS via worker_thread_cleanup

LightFTP 2.3.1 contains a residual race condition vulnerability an incomplete fix for CVE-2024-11144 in the workerthreadcleanup function of ftpserv.c that allows remote unauthenticated attackers to destabilize or crash the daemon by triggering unsynchronized access to shared per-connection state...

CVE-2026-67607

LightFTP 2.3.1 contains a residual race condition vulnerability an incomplete fix for CVE-2024-11144 in the workerthreadcleanup function of ftpserv.c that allows remote unauthenticated attackers to destabilize or crash the daemon by triggering unsynchronized access to shared per-connection state...

CVE-2026-67607 LightFTP 2.3.1 Race Condition DoS via worker_thread_cleanup

LightFTP 2.3.1 contains a residual race condition vulnerability an incomplete fix for CVE-2024-11144 in the workerthreadcleanup function of ftpserv.c that allows remote unauthenticated attackers to destabilize or crash the daemon by triggering unsynchronized access to shared per-connection state...

CVE-2026-67607

LightFTP 2.3.1 is affected by a race-condition DoS vulnerability where a fresh FTP connection reuses context during an in-progress ABRT cleanup, exposing an unprotected re-check of WorkerThreadId between worker_thread_cleanup() and pthread_join() outside MTLock. This can cause pthread_join() to o...

CVE-2026-18157

A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injection vulnerability in the APT backend. This allows specially crafted package names, which begin with a hyphen, to be misinterpreted as command options by apt-ge...

CVE-2026-18157 Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: remote code execution via apt argument injection

A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injection vulnerability in the APT backend. This allows specially crafted package names, which begin with a hyphen, to be misinterpreted as command options by apt-ge...

EUVD-2026-51380

A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injection vulnerability in the APT backend. This allows specially crafted package names, which begin with a hyphen, to be misinterpreted as command options by apt-ge...

CVE-2026-18157

CVE-2026-18157 concerns the yggdrasil-worker-package-manager. A local attacker with existing system access can exploit an argument injection vulnerability in the APT backend, where specially crafted package names beginning with a hyphen are misinterpreted as apt-get options. Successful exploitati...

PT-2026-66668

Name of the Vulnerable Software and Affected Versions yggdrasil-worker-package-manager affected versions not specified Description An argument injection flaw exists in the APT backend. A local attacker with system access can use specially crafted package names starting with a hyphen to trick...

CVE-2026-18157: Improper Neutralization of Argument Delimiters in a Command

A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injection vulnerability in the APT backend. This allows specially crafted package names, which begin with a hyphen, to be misinterpreted as command options by apt-ge...

SUSE CVE-2026-35458

Gotenberg is an API for converting document formats. In 8.29.1 and earlier, Gotenberg uses dlclark/regexp2 to compile user-supplied scope patterns without setting a proper timeout. Users with access to features using this logic can hang workers indefinitely...

CVE-2026-14318 GiveWP < 4.16.3 - GiveWP Worker+ Stored XSS via Donation Form Template Settings

The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the GiveWP Worker role and above to inject arbitrary web scripts that execute on the public donation form viewed by any visitor...

CVE-2026-14318

The GiveWP WordPress plugin, in versions prior to 4.16.3 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The issue stems from a failure to escape a donation-form template setting before it is outputted into an HTML attribute. This allows authenticated users with the GiveWP Worker rol...

CVE-2026-14318 GiveWP < 4.16.3 - GiveWP Worker+ Stored XSS via Donation Form Template Settings

The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the GiveWP Worker role and above to inject arbitrary web scripts that execute on the public donation form viewed by any visitor...

EUVD-2026-50995

The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the GiveWP Worker role and above to inject arbitrary web scripts that execute on the public donation form viewed by any visitor...

CVE-2026-14318

The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the GiveWP Worker role and above to inject arbitrary web scripts that execute on the public donation form viewed by any visitor...

CVE-2026-17824

Insufficient policy enforcement in ServiceWorker in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: Medium...