4925 matches found
mariadb: MariaDB: Privilege bypass allows unauthorized file write via subqueries
A flaw was found in MariaDB server. This vulnerability allows a low-privileged authenticated user to bypass a security control that normally restricts file operations. Specifically, the system failed to verify the necessary 'FILE' privilege when certain 'SELECT' statements, which write data to...
php: signed integer overflow in metaphone()
A flaw was found in PHP. The metaphone function in ext/standard/metaphone.c uses a signed int variable to track the current position within the input string. When an input string is longer than 2,147,483,647 bytes, a signed integer overflow can occur, leading to undefined behavior and an...
CVE-2023-45133 vulnerabilities
Vulnerabilities for packages: arangodb, awx...
CVE-2026-45804 vulnerabilities
Vulnerabilities for packages: py3-diffusers-cuda-12.9, py3-diffusers-cuda-13.0...
glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width
A flaw was found in glibc GNU C Library. This vulnerability occurs when an application uses the scanf family of functions with a %mc format specifier, which is used for dynamically allocating memory for character input, and provides an explicit width greater than 1024. This specific combination c...
GHSA-9GGV-8W38-R7PM vulnerabilities
Vulnerabilities for packages: redisinsight...
CVE-2026-11979
libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell function processes user input using fixed-size stack buffers without proper bounds checking. By supplying an overly long input line, an attacker can overflow intern...
CVE-2026-13601
A flaw was found in Yelp due to an overly permissive Content Security Policy CSP implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document,...
ROS-20260629-73-0002
The vulnerability in ImageMagick 7 is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...
GHSA-R2JR-M2RH-F5HG vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2026-54896 vulnerabilities
Vulnerabilities for packages: ruby4.0-fluentd-kubernetes-daemonset, ruby3.4-fluentd-kubernetes-daemonset, kube-logging-operator, ruby3.2-fluentd-kubernetes-daemonset, ruby3.3-fluentd-kubernetes-daemonset...
CVE-2026-30405 vulnerabilities
Vulnerabilities for packages: kube-vip-fips, kube-vip, cilium-cli...
CVE-2026-46604
The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset...
GHSA-52X6-GQ3R-VPF4 vulnerabilities
Vulnerabilities for packages: open-webui...
GHSA-MPWR-8VM7-H73F vulnerabilities
Vulnerabilities for packages: crossplane-provider-azure-sql, nfpm, splunk-otel-collector, gobuster, goreleaser, cert-manager, crossplane-provider-family-azure, crossplane-provider-azure-managedidentity, grafana, crossplane-provider-azure-storage, x509-certificate-exporter, nuclei,...
CVE-2026-46601 vulnerabilities
Vulnerabilities for packages: mailpit, bento, ollama, pdfcpu, rclone, kubescape, seaweedfs, mattermost, gitea...
CVE-2026-57918
libnfs through 6.0.2 before 935b8db has an xid integer underflow in READIOVEC in rpcreadfromsocket in lib/socket.c during a connection to a crafted NFS server, when the expected pdu size exceeds the absolute pdu size from the xid/record-marker...
SUSE CVE-2026-57434
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from Nokogiri::XML::Node. This caused a NULL pointer dereference that could...
CVE-2026-6331
HMAC zero-length tag forgery in EVPDigestVerifyFinal, where a zero-length tag could be accepted as valid during HMAC verification. In the OpenSSL-compatibility HMAC verify path the supplied signature length was only checked as not exceeding the MAC length, so a zero-length or otherwise truncated...