CVE-2026-94656 affecting package thrift for versions less than 0.25.0-1

CVE-2026-94656 affecting package thrift for versions less than 0.25.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-96990 affecting package thrift for versions less than 0.25.0-1

CVE-2026-96990 affecting package thrift for versions less than 0.25.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-94653 affecting package thrift for versions less than 0.25.0-1

CVE-2026-94653 affecting package thrift for versions less than 0.25.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-94658 affecting package thrift for versions less than 0.25.0-1

CVE-2026-94658 affecting package thrift for versions less than 0.25.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-87117 affecting package thrift for versions less than 0.25.0-1

CVE-2026-87117 affecting package thrift for versions less than 0.25.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-94655 affecting package thrift for versions less than 0.25.0-1

CVE-2026-94655 affecting package thrift for versions less than 0.25.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-91137 affecting package thrift for versions less than 0.25.0-1

CVE-2026-91137 affecting package thrift for versions less than 0.25.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-94648 affecting package thrift for versions less than 0.25.0-1

CVE-2026-94648 affecting package thrift for versions less than 0.25.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-102557 affecting package libsoup for versions less than 3.4.4-17

CVE-2026-102557 affecting package libsoup for versions less than 3.4.4-17. A patched version of the package is available...

CVE-2026-102556 affecting package libsoup for versions less than 3.4.4-17

CVE-2026-102556 affecting package libsoup for versions less than 3.4.4-17. A patched version of the package is available...

CVE-2026-85087 affecting package thrift for versions less than 0.25.0-1

CVE-2026-85087 affecting package thrift for versions less than 0.25.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-77406 affecting package telegraf for versions less than 1.31.0-34

CVE-2026-77406 affecting package telegraf for versions less than 1.31.0-34. An upgraded version of the package is available that resolves this issue...

USN-8914-1: Google Guest Agent, Google OS Config Agent vulnerability

It was discovered that the Go x/net/idna package, vendored in Google Guest Agent and Google OS Config Agent, incorrectly accepted Punycode-encoded labels that decoded to ASCII-only labels when processing internationalized domain names. A remote attacker could possibly use this issue to bypass...

CVE-2026-103503

Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and holds a certificate for a Hex host issued by a CA in Hex's bundled CA store, to impersonate that host to users who set cacertspath to a CA store that leaves that CA out...

CVE-2026-109399

SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdatecmsverifyopenssl.c that trusts untrusted X.509 certificates embedded in CMS SignedData for chain building. Attackers holding a signing key from a sibling intermediate under the same root can emb...

CVE-2026-105081

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowing configured policy restrictions to be bypassed. Local attackers who can create a symlink can point it at a policy-restricted path to eva...

tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects

A flaw was found in Tornado's SimpleAsyncHTTPClient. When following a redirect to a different origin, the client improperly retains and forwards sensitive authentication credentials, such as Authorization headers, to the new, potentially untrusted, destination. This vulnerability allows a remote...

rmcp: RMCP: Denial of Service via unauthenticated session table leak

A flaw was found in rmcp, a Rust SDK for the Model Context Protocol. An unauthenticated remote attacker can send specially crafted JSON-RPC POST requests to the stateful Streamable HTTP server. These requests cause the server to create and permanently retain session and channel state without prop...

goose: Goose: Arbitrary command execution via malicious Git configuration in `goose review`

A flaw was found in goose, a general-purpose AI agent. The goose review command, which uses the system's Git executable, does not properly strip attacker-controlled Git configuration. A malicious Git repository can set the core.fsmonitor option in its configuration, causing Git to execute arbitra...

rustls-webpki: rustls-webpki: Denial of Service via crafted Certificate Revocation List

A flaw was found in rustls-webpki. A remote attacker, by influencing an application to parse a specially crafted Certificate Revocation List CRL that contains an empty onlySomeReasons value in its issuingDistributionPoint extension, could trigger a panic. This vulnerability leads to a denial of...