SUSE SLES15 Security Update : helm (SUSE-SU-2026:1483-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1483-1 advisory. - CVE-2025-55199: crafted JSON Schema can lead to out of memory OOM termination bsc1248093. - CVE-2026-35206: files written to...

Unity Linux 20.1050e / 20.1070e Security Update: kernel (UTSA-2026-011205)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011205 advisory. In the Linux kernel, the following vulnerability has been resolved: fuse: fix livelock in synchronous file put from fuseblk workers I observed a hang when running...

CVE-2026-29644

XiangShan open-source high-performance RISC-V processor commit edb1dfaf7d290ae99724594507dc46c2c2125384 2024-11-28 has improper gating of its distributed CSR write-enable path, allowing illegal CSR write attempts to alter custom PMA Physical Memory Attribute CSR state. Though the RISC-V privilege...

CVE-2026-29644

CVE-2026-29644 concerns XiangShan, an open-source high-performance RISC-V processor. The issue arises from improper gating of the distributed CSR write-enable path in the commit edb1dfaf7d290ae99724594507dc46c2c2125384 (2024-11-28), which can allow illegal CSR write attempts to alter the custom P...

OpenEXR 输入验证错误漏洞

OpenEXR is an open standard for high dynamic range image HDR file format, open-sourced by the Academy Software Foundation. Versions 3.4.0 to 3.4.9 of OpenEXR contain a input validation vulnerability. This vulnerability stems from an integer overflow in the 32-bit signed integer bpl value of the...

Linux Distros Unpatched Vulnerability : CVE-2026-39377

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions 6.5 through 7.17.0 allow arbitrary file...

CVE-2026-29644

XiangShan open-source high-performance RISC-V processor commit edb1dfaf7d290ae99724594507dc46c2c2125384 2024-11-28 has improper gating of its distributed CSR write-enable path, allowing illegal CSR write attempts to alter custom PMA Physical Memory Attribute CSR state. Though the RISC-V privilege...

nbconvert 路径遍历漏洞

nbconvert is a format conversion library from the Jupyter organization. It converts Jupyter .ipynb notebook files into other static formats, including HTML, LaTeX, PDF, Markdown, etc. Version 6.5 to 7.17.0 of nbconvert has a path traversal vulnerability. This vulnerability stems from the improper...

Oracle VM VirtualBox 安全漏洞

Oracle VM VirtualBox is a desktop virtualization software developed by Oracle to run multiple operating systems on a single host. A memory corruption vulnerability exists in Oracle VM VirtualBox. The vulnerability stems from a failure of the Core component to properly handle memory operations and...

PT-2026-33980

XiangShan open-source high-performance RISC-V processor commit edb1dfaf7d290ae99724594507dc46c2c2125384 2024-11-28 has improper gating of its distributed CSR write-enable path, allowing illegal CSR write attempts to alter custom PMA Physical Memory Attribute CSR state. Though the RISC-V privilege...

Unity Linux 20.1050e / 20.1070e Security Update: kernel (UTSA-2026-010850)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-010850 advisory. In the Linux kernel, the following vulnerability has been resolved: nilfs2: do not write dirty data after degenerating to read-only According to syzbot's report,...

EUVD-2026-23958

In OpenXiangShan NEMU prior to 55295c4, when running with RVH Hypervisor extension enabled, a VS-mode guest write to the supervisor interrupt-enable CSR sie may be handled incorrectly and can influence machine-level interrupt enable state mie. This breaks privilege/virtualization isolation and ca...

CVE-2026-35402

mcp-neo4j-cypher is an MCP server for executing Cypher queries against Neo4j databases. In versions prior to 0.6.0, the readonly mode enforcement can be bypassed using APOC CALL procedures, potentially allowing unauthorized write operations or server-side request forgery. This issue is fixed in...

CVE-2026-40491

gdown is a Google Drive public file/folder downloader. Versions prior to 5.2.2 are vulnerable to a Path Traversal attack within the extractall functionality. When extracting a maliciously crafted ZIP or TAR archive, the library fails to sanitize or validate the filenames of the archive members...

CVE-2026-41245

Junrar is an open source java RAR archive library. Prior to version 7.5.10, a path traversal vulnerability in LocalFolderExtractor allows an attacker to write arbitrary files with attacker-controlled content into sibling directories when a crafted RAR archive is extracted. Version 7.5.10 fixes th...

Junrar 安全漏洞

Junrar is an open-source Java Unrar library developed by junrar. It is used for reading and extracting .Rar files. Versions of Junrar prior to 7.5.10 had security vulnerabilities, stemming from a path traversal vulnerability in LocalFolderExtractor. This vulnerability could allow writing to...

NEMU 安全漏洞

NEMU is an open-source teaching system simulator developed by XiangShan. Previous versions of NEMU 55295c4 contained security vulnerabilities. These vulnerabilities stemmed from improper handling of writes to sie CSR when the RVH extension was enabled. This improper handling could affect the...

CVE-2026-29642

CVE-2026-29642 affects XiangShan (RISC-V) and is triggered by local access performing privileged CSR operations on menvcfg (e.g., csrrs in M-mode). Careful reads/writes can cause WPRI bits in the status view (xstatus) to be set to 1, despite WPRI being defined as values that should not be modifie...

Improper Validation of Specified Index, Position, or Offset in Input

Overview uuid is a RFC4122 v1, v4, and v5 compliant UUID library. Affected versions of this package are vulnerable to Improper Validation of Specified Index, Position, or Offset in Input due to accepting external output buffers but not rejecting out-of-range writes small buf or large offset. This...

Improper Validation of Specified Index, Position, or Offset in Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Index, Position, or Offset in Input due to accepting external output buffers but not rejecting out-of-range writes small buf or large offset. This inconsistency allows silent partial writes into...