Connected evidence
Follow a shared identifier, source page or planning group across source records. Dates show chronology; a connection does not establish cause, a shared rollout or applicability to your environment.
Saved searches 0
Keep up to eight named searches. Saved in this browser. Filters are also shareable in the page address.
Threads
Related changes across sources- Nuxt dev server exposes generated appSecret through Vite file serving Advisory content revised: Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, nuxt dev stores a generated appSecret in <buildDir>/app-secret, by default .nuxt/app-secret, within a directory allowed by Vite's server.fs configuration. …3 linked entries across history · in Security Follow evidence and connection reasons
- @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service Advisory content revised: @hapi/content provides HTTP Content-* header parsing. From 3.0.6 until 6.0.3, Content.disposition() uses an unanchored parameter-name expression in a global regular-expression scan, causing repeated failed matching over the remaining input …3 linked entries across history · in Security Follow evidence and connection reasons
- Jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: jboss deserialization rce via unfiltered river unmarshaller Affected-version evidence changed2 linked entries across history · in Security Follow evidence and connection reasons
- Wildfly-iiop-openjdk: missing authentication on eap's iiop nameservice leads to mitm or dos Affected-version evidence changed2 linked entries across history · in Security Follow evidence and connection reasons
- WordPress FunnelKit Automations plugin <= 3.8.6.1 - PHP Object Injection vulnerability Affected-version evidence changed2 linked entries across history · in Security Follow evidence and connection reasons
- ntfs: move attribute payload before shrinking its record Affected-version evidence changed2 linked entries across history · in Security Follow evidence and connection reasons
- MC1510951: (Updated) Windows updates are available for 2026 time zone changes in Canada Notice updated: MC1526697: Dynamics 365 apps and Dataverse – Information about the 2026 time zone changes in Canada4 linked entries across history · in Microsoft 365 Follow evidence and connection reasons
- GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c. Affected-version evidence changed: GNU mtools before 4.0.50 has an out-of-bounds write in parse_vses in vfat.c.3 linked entries across history · in Security Follow evidence and connection reasons
- Vite: `server.fs.deny` bypassed with queries Advisory content revised: Vite is a frontend tooling framework for JavaScript. From 6.4.4 until 6.4.5, the Vite development server can evaluate server.fs.deny before stripping loader query parameters such as ?raw, ?import&raw, or ?import&url&inline. When the develop…3 linked entries across history · in Security Follow evidence and connection reasons
- smb: client: fix heap overflow in cifs_do_set_acl() Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
- net/sched: cls_flower: validate mask pointer after nla_next() Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
- net: bridge: mcast: don't truncate the port group walk on teardown Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
- vsock/virtio: validate packet source for connected sockets Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
- xfs: fix capability check in xfs Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
- dm-crypt: fix a tiny race condition in crypt_dec_pending Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
- tracing: Check operator stack capacity before pushing Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
- tracing: Keep the predicate limit separate from program capacity Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
- scsi: libiscsi: Validate the task named by a management response Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
- scsi: st: Fix use-after-free race between st_remove() and st_open() Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
- tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
- net/sched: fix use-after-free in __tcf_action_put() Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
- eventfs: Free the eventfs_inode after an rcu grace period too Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
- unicode: free the map after a grace period Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
- pipe: preserve existing fasync readers on writer setup failure Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
- net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
- vsock: treat TCP_CLOSING as once-established Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
- Drivers: hv: Don't reset VMBus connection state on error/exit paths Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
- Azure Virtual Desktop agent changes Guidance changed3 linked entries across history · in Azure Follow evidence and connection reasons
- npm package `expr-eval` is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary code execution. The npm expr-eval-fork package resolve… Source changes critical severity rating2 linked entries across history · in Security Follow evidence and connection reasons
- Stackrox: stackrox: saml response replay allows multiple central authentication tokens Affected-version evidence changed2 linked entries across history · in Security Follow evidence and connection reasons