BuildKit has a possible runtime DoS via unbounded group parsing

Impact Maliciously crafted base image or build can cause a Denial of Service DoS condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory OOM kill of the buildkitd process. Patches Issue is fixed in BuildKit v0.31.1+ Workarounds Use trusted build...

CVE-2026-18315

creationtimestamp| type| source ---|---|--- 2026-08-19 20:11:57+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mthk3xuqgd2u 2026-08-20 00:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mthz3giigf2u 2026-08-21 00:00:08+00:00| published-proof-of-concept|...

CVE-2026-71866

creationtimestamp| type| source ---|---|--- 2026-08-19 20:10:33+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mthjzhs6lx2e 2026-08-20 00:10:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mthxfrxthy25 2026-09-02 16:35:20+00:00| published-proof-of-concept|...

CVE-2026-75593 BuildKit: Malicious client can bypass destination directory validation on local sources upload

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to...

CVE-2026-22306 Critical flaw impacting OZOLS ERP's automatic update channel

Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext transmission of sensitive information vulnerability in Ozols Grupa OZOLS on Windows caused by an abandoned auto-update domain. Affected component: the automatic update channel...

qemu v11.1.0

=========== QEMU README QEMU is a generic and open source machine & userspace emulator and virtualizer. QEMU is capable of emulating a complete machine in software without any need for hardware virtualization support. By using dynamic translation, it achieves very good performance. QEMU can also...

CVE-2026-52792

Algernon is a small self-contained pure-Go web server. Prior to 1.17.9, Algernon on Windows selects a file handler in engine/handlers.go by calling filepath.Ext without first rejecting NTFS-equivalent names such as x.lua::$DATA, x.lua., and x.lua . An unauthenticated client can append one of thes...

ALPINE-CVE-2026-48711

SSHFS is a network filesystem client for connecting to SSH servers. From version 1.4 until 3.7.6, SSHFS accepts a bracketed mount source such as -oProxyCommand=CMD:/path and findbasepath removes the brackets, leaving a host value that begins with - and is passed directly to ssh as a command-line...

AZL-97014 CVE-2026-48711 affecting package fuse-sshfs 3.7.3-1

SSHFS is a network filesystem client for connecting to SSH servers. From version 1.4 until 3.7.6, SSHFS accepts a bracketed mount source such as -oProxyCommand=CMD:/path and findbasepath removes the brackets, leaving a host value that begins with - and is passed directly to ssh as a command-line...

infisical v0.162.21

The open-source secret management platform : Sync secrets/configs across your team/infrastructure and prevent secret leaks. Slack | Infisical Cloud | Self-Hosting | Docs | Website | Twitter | Hiring Remote/SF Introduction Infisical is the open source security infrastructure platform that teams us...

CVE-2026-52792

Algernon (a pure-Go web server) prior to 1.17.9 is vulnerable to server-side script source disclosure on Windows via NTFS filename aliasing. The root cause is in engine/handlers.go: filepath.Ext() does not recognize NTFS-equivalent suffixes (::$DATA, trailing dot, trailing space) as the script ex...

CVE-2026-52792 Algernon: Server-side script source disclosure on Windows via NTFS filename

Algernon is a small self-contained pure-Go web server. Prior to 1.17.9, Algernon on Windows selects a file handler in engine/handlers.go by calling filepath.Ext without first rejecting NTFS-equivalent names such as x.lua::$DATA, x.lua., and x.lua . An unauthenticated client can append one of thes...

CVE-2026-52792 Algernon: Server-side script source disclosure on Windows via NTFS filename

Algernon is a small self-contained pure-Go web server. Prior to 1.17.9, Algernon on Windows selects a file handler in engine/handlers.go by calling filepath.Ext without first rejecting NTFS-equivalent names such as x.lua::$DATA, x.lua., and x.lua . An unauthenticated client can append one of thes...

CVE-2026-48711

SSHFS (a network filesystem client for SSH) is vulnerable to argument injection in its find_base_path() function. From version 1.4 through 3.7.5, a bracketed mount source such as [-oProxyCommand=CMD]:/path has its brackets stripped, leaving a host value beginning with - that is passed directly to...

EUVD-2026-62494

SSHFS is a network filesystem client for connecting to SSH servers. From version 1.4 until 3.7.6, SSHFS accepts a bracketed mount source such as -oProxyCommand=CMD:/path and findbasepath removes the brackets, leaving a host value that begins with - and is passed directly to ssh as a command-line...

CVE-2026-48711 SSHFS: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

SSHFS is a network filesystem client for connecting to SSH servers. From version 1.4 until 3.7.6, SSHFS accepts a bracketed mount source such as -oProxyCommand=CMD:/path and findbasepath removes the brackets, leaving a host value that begins with - and is passed directly to ssh as a command-line...

CVE-2026-48711 SSHFS: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

SSHFS is a network filesystem client for connecting to SSH servers. From version 1.4 until 3.7.6, SSHFS accepts a bracketed mount source such as -oProxyCommand=CMD:/path and findbasepath removes the brackets, leaving a host value that begins with - and is passed directly to ssh as a command-line...

CVE-2026-45272

MyBooks (also known as Talebook), a personal ebook management web server, is vulnerable to remote code execution in versions 3.41.2 and earlier . The root cause is a Python code injection via the AdminSettings.post handler in webserver/handlers/admin.py, which accepts SOCIAL_AUTH key names withou...

CVE-2026-70906

creationtimestamp| type| source ---|---|--- 2026-08-19 13:35:17+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mtgtwox6lk2o 2026-08-19 17:52:27+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10 2026-08-19 21:03:36+00:00| seen|...

acdc-aws-etl-pipeline (>=0.1.7, <=0.5.9), acryl-datahub-gx-plugin (>=0.14.0.3rc1, <=0.15.0rc15) +690 more potentially affected by CVE-2026-59894 via sqlparse (>=0.1.14, <=0.5.5)

sqlparse PYPI version =0.1.14, =0.1.7, =0.14.0.3rc1, =2.0.0, =0.2.0, =0.0.1, =1.0.6, =0.1.0, =2.0.0, =0.8.0, =0.0.1a0, =0.1.0, =0.1.4 and more Source cves: CVE-2026-59894 Source advisory: OSV:PYSEC-2026-3696...