GHSA-6R7G-3MM3-FHW7 vulnerabilities

Vulnerabilities for packages: nodejs...

CVE-2026-5732 vulnerabilities

Vulnerabilities for packages: firefox-esr, firefox...

php: heap-based buffer overflow in array_merge()

A flaw was found in PHP. A heap-based buffer overflow occurs in the arraymerge function when the total element count of packed arrays exceeds the 32-bit limit or the internal HTMAXSIZE due to an integer overflow in the precomputation of element counts using the zendhashnumelements function, causi...

bind: SIG(0) validation during query flood may lead to undefined behavior

A flaw was found in BIND. A remote attacker could exploit a race condition during SIG0 signature validation of an incoming DNS message. If the "recursive-clients" limit is reached and the message is discarded, a use-after-free vulnerability may occur. This could lead to undefined behavior and...

CVE-2026-40200

An issue was discovered in musl libc 0.7.10 through 1.2.6. Stack-based memory corruption can occur during qsort of very large arrays, due to incorrectly implemented double-word primitives. The number of elements must exceed about seven million, i.e., the 32nd Leonardo number on 32-bit platforms o...

CVE-2026-40227

In systemd 260 before 261, a local unprivileged user can trigger an assert via an IPC API call with an array or map that has a null element...

GHSA-3P68-RC4W-QGX5 vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu, kubeflow-pipelines, langfuse, prism, opensearch-dashboards, nextcloud-server, lerna, kubeflow-katib, saf, kubeflow-centraldashboard...

golang: cmd/compile: no-op interface conversion bypasses overlap checking

A flaw was found in the cmd/compile package in the Go standard library. A no-op interface conversion prevented the compiler from correctly identifying non-overlapping memory moves. As a result, the compiler allows unsafe memory move operations to occur at runtime, potentially causing data...

GHSA-3P68-RC4W-QGX5 vulnerabilities

Vulnerabilities for packages: redisinsight, langfuse-fips, saf, kubeflow-katib, kibana, opensearch-dashboards, gitlab-rails-ce, kubeflow-centraldashboard, opensearch-dashboards-fips, awx, kubeflow-pipelines, langfuse, librechat, gitlab-rails-ce-fips, prism, lerna, nextcloud-server, jitsucom-jitsu...

CVE-2026-5500

wolfSSL's wcPKCS7DecodeAuthEnvelopedData does not properly sanitize the AES-GCM authentication tag length received and has no lower bounds check. A man-in-the-middle can therefore truncate the mac field from 16 bytes to 1 byte, reducing the tag check from 2⁻¹²⁸ to 2⁻⁸...

GHSA-3MWP-WVH9-7528 vulnerabilities

Vulnerabilities for packages: py3-vllm-cuda-12.4, tritonserver-backend-vllm-cuda-13.0, vllm-openai-cuda-12.9...

GHSA-43RW-359F-4H89 vulnerabilities

Vulnerabilities for packages: python...

CVE-2026-39859 vulnerabilities

Vulnerabilities for packages: kibana...

GHSA-MJMQ-GWGM-5QHM vulnerabilities

Vulnerabilities for packages: hadoop-fips...

GHSA-JR6H-R7VG-F9MC vulnerabilities

Vulnerabilities for packages: druid...

GHSA-5MF9-H53Q-7MHQ vulnerabilities

Vulnerabilities for packages: awx, authentik, authentik-fips, label-studio...

CVE-2026-33034 vulnerabilities

Vulnerabilities for packages: awx, authentik, authentik-fips, label-studio...

ROS-20260410-73-0017

Vulnerability in expat related to null pointer dereferencing. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

ROS-20260410-73-0009

Vulnerability in libssh related to incorrect external control of file name or path. Exploitation of the vulnerability could allow an attacker to escalate privileges...

ROS-20260410-73-0016

Vulnerability in curl related to authentication bypass due to an initial bug. Exploitation of the vulnerability could allow an attacker acting remotely to escalate their privileges...