2099412 matches found
MINI-W34C-V7CF-4VVX
Bulletin has no description...
MINI-G3M4-Q3W2-R766
Bulletin has no description...
MINI-7934-P72G-GM4P
Bulletin has no description...
MAL-2026-16374 Malicious code in test-react-app-in (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ebade640fa6ac69a17ff3a928d1fc0637eb0a32786093578c953de7e56c52231 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-16375 Malicious code in test-react-app-out (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 37116c57e577d1e9271e66cf5cc5171bd4c792456b2f581dc060e00714864291 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-16376 Malicious code in test-react-app-way (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8dd5c5cfe4731b46d1c41c5302999050eb7a5a29864805bf75e3cb22a661237a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
DEBIAN-CVE-2026-93710
Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compilehooks. A hook that dies fires core.app.hookexception, then calls cleanup unless the failing hook is the exception handler. A handler that halts does...
DEBIAN-CVE-2026-93711
Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headerstoarray. The routine removes CR and LF from each header value but not from the name. A name carrying them therefore reaches the PSGI server intact. A server that does not validate keys writes it to...
DEBIAN-CVE-2026-93709
Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. The handler compares the request path against the layout directory name as text, while the lookup that follows canonicalises it. A doubled slash, a dot...
DEBIAN-CVE-2026-93712
Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside publicdir via relative path segments in the File route handler. The handler joins the request path onto publicdir without collapsing relative segments, and checks only that the result is a readable regular file. A request...
CVE-2026-93712 Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler
Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside publicdir via relative path segments in the File route handler. The handler joins the request path onto publicdir without collapsing relative segments, and checks only that the result is a readable regular file. A request...
CVE-2026-93711 Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array
Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headerstoarray. The routine removes CR and LF from each header value but not from the name. A name carrying them therefore reaches the PSGI server intact. A server that does not validate keys writes it to...
CVE-2026-93710 Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooks
Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compilehooks. A hook that dies fires core.app.hookexception, then calls cleanup unless the failing hook is the exception handler. A handler that halts does...
CVE-2026-93709 Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler
Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. The handler compares the request path against the layout directory name as text, while the lookup that follows canonicalises it. A doubled slash, a dot...
CLEANSTART-2026-YY11796 gRPC-Go is the Go language implementation of gRPC
CVE-2026-84303 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...
CLEANSTART-2026-UP97351 gRPC-Go is the Go language implementation of gRPC
CVE-2026-84445 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...
CLEANSTART-2026-KN43296 OpenTelemetry-Go is the Go implementation of OpenTelemetry
CVE-2026-81870 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...
CLEANSTART-2026-XR77764 gRPC-Go is the Go language implementation of gRPC
CVE-2026-84304 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...
CLEANSTART-2026-AL86944 Previously, resolving relative paths containing parent directory ('
CVE-2026-56860 affects multiple packages. Previously, resolving relative paths containing parent directory '. See references for individual vulnerability details...
CLEANSTART-2026-XY58931 Previously, a channel registered in the mux's chanList is not usable until it is established
CVE-2026-78662 affects multiple packages. Previously, a channel registered in the mux's chanList is not usable until it is established. See references for individual vulnerability details...
CLEANSTART-2026-GJ17760 Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not
Security vulnerability affects the argo-cd package. Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not...
CLEANSTART-2026-TD63490 Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion
Security vulnerability affects the argo-cd package. Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...
CLEANSTART-2026-RI09437 Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS
CVE-2026-56858 affects multiple packages. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. See references for individual vulnerability details...
CLEANSTART-2026-YI88599 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...
CVE-2026-56854 affects multiple packages. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. See references for individual vulnerability...
CLEANSTART-2026-OV04527 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection
CVE-2026-56855 affects multiple packages. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details...
CLEANSTART-2026-YX17879 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface
Security vulnerability affects the argo-cd package. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface...
CLEANSTART-2026-SC24710 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer
Security vulnerability affects the argo-cd package. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer...
CLEANSTART-2026-QZ52453 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label
CVE-2026-39821 affects multiple packages. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...
CLEANSTART-2026-ET86515 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures
Security vulnerability affects the argo-cd package. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...
CLEANSTART-2026-MT48554 OpenTelemetry-Go is the Go implementation of OpenTelemetry
CVE-2026-81871 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...
CLEANSTART-2026-FM06572 OpenTelemetry-Go is the Go implementation of OpenTelemetry
Security vulnerability affects the cortex package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...
CLEANSTART-2026-AZ15466 etcd is a distributed key-value store for the data of a distributed system
Security vulnerability affects the cortex package. etcd is a distributed key-value store for the data of a distributed system...
OSV-2026-1314 Heap-buffer-overflow in vacm_getAccessEntry
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=564017938 Crash type: Heap-buffer-overflow READ 3 Crash state: vacmgetAccessEntry snmpsecmodelsfuzzer.c...
MAL-2026-16372 Malicious code in @zig-design-system/react (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c1247992d3c2b02f93cea726189a4ff0a25eef9535b2a34eb7a120f8c9496f67 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-16373 Malicious code in wos-library (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 524ae7b1915578b6502bbdcad69264369a3d7fe728a7eb0e507e9a3055a37749 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-16371 Malicious code in @vite-tab/tabui (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ec35d5c09558092f8480d118a1b921f3e30e1edd37ace970d3a69a6fc3799d2c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CGA-HGVV-78RH-R67V
Bulletin has no description...
DEBIAN-CVE-2026-79079
An issue in CrossWire Xiphos = 4.3.2 allows a local attacker to execute arbitrary code via the src/main/url.cc and src/gtk/menupopup.c components...
CGA-8Q6H-5PVG-JFCG
Bulletin has no description...
CVE-2026-94627 vLLM through 0.29.0 GPU KV Cache Leak via Mooncake Transfer ID Collision
vLLM Mooncake connector through 0.29.0 fails to properly manage GPU KV cache block ownership when concurrent child requests share a single transfer ID in prefill/decode disaggregated deployments. Attackers can trigger GPU memory exhaustion by submitting completion requests with multiple prompts,...
CVE-2026-94626 vLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL tp_size
vLLM through 0.29.0 fails to validate the tpsize parameter in kvtransferparams on OpenAI-compatible completion endpoints, allowing attackers to allocate unbounded memory. Attackers can supply arbitrary tpsize values in prefill/decode disaggregated deployments to exhaust memory and trigger kernel...
CVE-2026-94625 vLLM through 0.29.0 Resource Exhaustion via Ownerless Mooncake Transfer Placeholders
vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never reclaimed. Attackers can send rejected requests to exhaust sender task pools, causing valid requests to be delayed by up to 4...
CVE-2026-94624 vLLM through 0.29.0 Denial of Service via Unbounded P2P KV Offloading Sessions
vLLM through 0.29.0 contains a denial of service vulnerability in P2P KV offloading when OffloadingConnector is configured with TieringOffloadingSpec and a peer-to-peer secondary tier. Attackers can supply arbitrary remote host and port values in kvtransferparams to create unreachable peer sessio...
CVE-2026-94623 vLLM through 0.29.0 Denial of Service via NIXL Multi-Prompt Assertion Failure
vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly validate block counts across multi-prompt completion requests in prefill/decode disaggregated deployments. Attackers can trigger an assertion failure in...
CVE-2026-94622 vLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer Metadata
vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. Attackers can send requests with incomplete kvtransferparams dictionary entries to trigger an uncaught KeyError in EngineCore scheduling,...
CGA-R7VC-H835-M2GV
Bulletin has no description...
CGA-XC4J-6PV7-WJHC
Bulletin has no description...
GHSA-PXCX-FV34-X9P5 nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition
Summary POST /api/users/onboarding/finish is registered as anonymous unauthenticated and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act TOCTOU pattern between the "onboarding already completed?" check and the user-creation write, with no atomic...