CVE-2026-88048

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, FullyConnected::DeSerialize in src/lstm/fullyconnected.cpp does not validate the deserialized layer scalars ni and no against the weight-matrix dimensions. During FullyConnected::Forward, MatrixDotVector in...

GHSA-F2M7-5M7M-7G2C vulnerabilities

Vulnerabilities for packages: linux-qemu-melange...

CVE-2026-53024 vulnerabilities

Vulnerabilities for packages: linux-qemu-melange...

GHSA-8M3C-C648-2XJJ vulnerabilities

Vulnerabilities for packages: unleash, kibana, langfuse-fips, unleash-fips, langfuse...

GHSA-M93F-WJ8C-RP8P vulnerabilities

Vulnerabilities for packages: dotnet-bootstrap...

CVE-2026-75596 vulnerabilities

Vulnerabilities for packages: kayenta, pinot, flyway-fips, ghidra, cassandra-reaper, pinot-fips, management-api-for-apache-cassandra-4.0, logstash, druid, cruise-control, drain-cleaner-fips, commercial-elasticsearch, keycloak-fips, request-9047-keycloak-fips, neo4j, elasticsearch, hadoop-fips,...

CVE-2026-71613

Buffer Overflow vulnerability in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the j2kdecprocess function. Fixed in 9a253a07fd3f6b48022bba74302bf39388dda859...

Updated wget packages fix a security vulnerability

Denial of Service in GNU wget. CVE-2026-16599...

CVE-2026-87822

t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN values that bypass validation checks. Attackers can craft malicious serialized digests containing NaN centroids that degrade sorting performance fr...

CVE-2026-87795

zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashe...

GHSA-2V4P-QF9Q-27WJ vulnerabilities

Vulnerabilities for packages: conftest-fips, zarf-fips, restic, k8s-metacollector-fips, tbot, helm-operator-fips, flux-image-automation-controller-fips, cilium-cli, crossplane-provider-aws-cloudcontrol-fips, consul-k8s, crossplane-provider-aws-servicecatalog, knative-kafka-broker, cilium,...

CVE-2026-87732

An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml. The AES.GCM.authenticatedecryptinto and Chacha20.authenticatedecryptinto functions write the decrypted plaintext into a caller-provided buffer and only then compares the tag. On a forged tag, the functions returns false,...

firefox: thunderbird: Site isolation issue in the WebExtensions component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Site isolation issue in the WebExtensions component...

firefox: Privilege escalation in the Shell Integration component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the Shell Integration component...

firefox: thunderbird: Privilege escalation in the DOM: Networking component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the DOM: Networking component...

firefox: Integer overflow in the Graphics component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Integer overflow in the Graphics component...

firefox: thunderbird: Privilege escalation in the Graphics: CanvasWebGL component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the Graphics: CanvasWebGL component...

CVE-2026-87496

UI misrepresentation in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87604

Out of bounds read in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-87546

Incorrect type conversion or cast in Safebrowsing in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted file. Chromium security severity: Low...