1264 matches found
xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.
...
GHSA-W6C6-C85G-MMV6 vulnerabilities
Vulnerabilities for packages: policy-controller, ratify, commercial-chainloop-backend, ratify-fips, policy-controller-fips, kubescape-server-fips, chainctl-fips, aactl, kyverno-notation-aws-fips, trivy-operator-fips, cloudbeat, ko-fips, kyverno, trivy-operator, kyverno-notation-aws,...
CVE-2026-39395 vulnerabilities
Vulnerabilities for packages: policy-controller, ratify, commercial-chainloop-backend, ratify-fips, policy-controller-fips, kubescape-server-fips, chainctl-fips, aactl, kyverno-notation-aws-fips, trivy-operator-fips, cloudbeat, ko-fips, kyverno, trivy-operator, kyverno-notation-aws,...
RLSA-2023:6976 Moderate: libfastjson security update
The libfastjson library provides essential JavaScript Object Notation JSON handling functions. The library enables users to construct JSON objects in C, output them as JSON-formatted strings, and convert JSON-formatted strings back to the C representation of JSON objects. Security Fixes: json-c,...
CVE-2026-54350
Budibase is an open-source low-code platform. Prior to 3.39.12, an unauthenticated visitor of any published Budibase app reads every document of the backing MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, or REST-with-JSON-body collection and, where the builder has published a PUBLIC write...
GHSA-47Q9-M4WW-924M vulnerabilities
Vulnerabilities for packages: tbot, policy-controller, ratify, zarf, ratify-fips, policy-controller-fips, kubescape-server-fips, docker-fips, chainctl-fips, aactl, kyverno-notation-aws-fips, trivy-operator-fips, cloudbeat, ko-fips, kyverno, tkn, trivy-operator, kyverno-notation-aws, spire-server,...
CVE-2026-48702 vulnerabilities
Vulnerabilities for packages: tbot, policy-controller, ratify, zarf, ratify-fips, policy-controller-fips, kubescape-server-fips, docker-fips, chainctl-fips, aactl, kyverno-notation-aws-fips, trivy-operator-fips, cloudbeat, ko-fips, kyverno, tkn, trivy-operator, kyverno-notation-aws, spire-server,...
CVE-2026-48042
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, destructor of JSON Object results in stack overflow when deeply O100K nested objects are present. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1...
EUVD-2026-39145
Quest NetVault Backup NVBULibraryPort SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing...
ROS-20260625-73-0016
The vulnerability of the ASN.1 library Libtasn1 is related to its algorithmic complexity. Exploiting this vulnerability could allow a malicious actor to cause service failures...
CVE-2026-9785
Quest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing...
CVE-2026-48028
Mastodon (open-source social network server) versions prior to 4.5.10, 4.4.17, and 4.3.23 are affected. The vulnerability arises from how incoming activities signed with Linked-Data Signatures are normalized, failing to adequately protect against a class of spoofing that lets an attacker remove J...
CVE-2026-46349 Mastodon: LD-Signature Bypass via JSON-LD Named-Graph Restructuring
Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, Mastodon's normalization of incoming activities signed with Linked-Data Signatures does not sufficiently protect the activities from a certain class of spoofing, allowing attackers to...
RHEL 9 : libtasn1 (RHSA-2026:28253)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:28253 advisory. A library that provides Abstract Syntax Notation One ASN.1, as specified by the X.680 ITU-T recommendation parsing and structures management, and...
SUSE CVE-2026-56411
xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations...
ALSA-2026:28253 Low: libtasn1 security update
A library that provides Abstract Syntax Notation One ASN.1, as specified by the X.680 ITU-T recommendation parsing and structures management, and Distinguished Encoding Rules DER, as per X.690 encoding and decoding functions. Security Fixes: libtasn1: libtasn1: Denial of Service via stack-based...
Low: libtasn1 security update
A library that provides Abstract Syntax Notation One ASN.1, as specified by the X.680 ITU-T recommendation parsing and structures management, and Distinguished Encoding Rules DER, as per X.690 encoding and decoding functions. Security Fixes: libtasn1: libtasn1: Denial of Service via stack-based...
CVE-2026-56411
A flaw was found in libexpat, a software library used for parsing XML Extensible Markup Language documents. An attacker could exploit an integer overflow vulnerability in the xmlwf utility by crafting malicious NOTATION declarations. This could lead to the disclosure of sensitive information or...
