24507 matches found
net: openvswitch: reject oversized nested action attrs
...
usb: gadget: f_midi: cancel pending IN work before freeing the midi object
...
undici vulnerable to CRLF Injection via blob-like body 'type' property
...
fs/ntfs3: validate lcns_follow in log_replay conversion
...
Double-free in the iSNS attribute decoder in open-iscsi
...
staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop
...
iscsiuio control-socket authentication bypass in open-iscsi
...
usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown
...
remote limited file-write as root via discovery in open-iscsi
...
KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode
...
dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning
...
can: esd_usb: kill anchored URBs before freeing netdevs
...
smb: client: fix double-free in SMB2_close() replay
...
KVM: nVMX: Hide shadow VMCS right after VMCLEAR
...
Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()
...
sctp: don't free the ASCONF's own transport in DEL-IP processing
...
KVM: x86: Check for invalid/obsolete root *after* making MMU pages available
...
An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934). This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.
...
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**.
...
A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.
...
A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.
...
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
...
pip absolute path traversal during download from malicious package indexes
...
GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote DoS
...
Quadratic Behavior in xml.etree.ElementPath Index Predicates
...
Heap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXT decoding in erts external term format decoder
...
TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain
...
Denial of service via exponential certificate policy tree growth in path validation
...
epmd permanent DoS via EMFILE on accept(2) in erts
...
TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication
...
Binutils: gnu binutils: heap-buffer-overflow in linker leads to information disclosure and denial of service
...
Stack overflow in phar with circular symlinks
...
SQL injection in ext-pgsql via E'...' backslash breakout
...
posix-cpu-timers: Prevent UAF caused by non-leader exec() race
...
Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
...
perf/core: Detach event groups during remove_on_exec
...
Arbitrary Output Location Change in GNU Bison
...
Arbitrary Command Execution in GNU Bison
...
XML injection vulnerability in QDom comment, CDATA and processing-instruction serialization
...
Apache Thrift: c_glib heap out-of-bounds read in transport leftover-bytes path
...
Apache Thrift: c_glib TLS Client Missing Hostname Verification
...
Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()
...
crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents
...
drm/edid: fix OOB read in drm_parse_tiled_block()
...
net: usb: net1080: validate packet_len before pad-byte access in rx_fixup
...
Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform()
...
Azure SQL Database Elevation of Privilege Vulnerability
Incorrect permission assignment for critical resource in Azure SQL Database allows an authorized attacker to elevate privileges locally...
Microsoft Teams Spoofing Vulnerability
Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network...