Month: February 2026

Information published. Continue reading CVE-2025-23084 A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory.

This vulnerability affects Windows users of `path.join` API.→

Information published. Continue reading CVE-2021-44732 Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls_ssl_set_session() failure.→

Information published. Continue reading CVE-2023-42363 A use-after-free vulnerability was discovered in xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1.→

Information published. Continue reading CVE-2025-38181 calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().→

Information published. Continue reading CVE-2025-23163 net: vlan: don’t propagate flags on open→

Information published. Continue reading CVE-2023-4580 Push notifications stored on disk in private browsing mode were not being encrypted potentially allowing the leak of sensitive information. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2.→

Information published. Continue reading CVE-2020-36425 An issue was discovered in Arm Mbed TLS before 2.24.0. It incorrectly uses a revocationDate check when deciding whether to honor certificate revocation via a CRL. In some situations, an attacker can exploit this by changing the local clock.→

Information published. Continue reading CVE-2025-38182 ublk: santizize the arguments from userspace when adding a device→