CVE-2026-21022

Improper handling of insufficient permissions in Routines prior to SMR May-2026 Release 1 allows local attackers to access sensitive information...

CVE-2026-43284 affecting package kernel for versions less than 6.6.138.1-1

CVE-2026-43284 affecting package kernel for versions less than 6.6.138.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-43398 affecting package kernel for versions less than 6.6.138.1-1

CVE-2026-43398 affecting package kernel for versions less than 6.6.138.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-43474 affecting package kernel for versions less than 6.6.138.1-1

CVE-2026-43474 affecting package kernel for versions less than 6.6.138.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-43292 affecting package kernel for versions less than 6.6.138.1-1

CVE-2026-43292 affecting package kernel for versions less than 6.6.138.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-43300 affecting package kernel for versions less than 6.6.138.1-1

CVE-2026-43300 affecting package kernel for versions less than 6.6.138.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-71299 affecting package kernel for versions less than 6.6.138.1-1

CVE-2025-71299 affecting package kernel for versions less than 6.6.138.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-43321 affecting package kernel for versions less than 6.6.138.1-1

CVE-2026-43321 affecting package kernel for versions less than 6.6.138.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-39803: Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion. The chunked clause of 'Elixir.Bandit.HTTP1.Socket':readdata/2 in lib/bandit/http1/socket.ex ignores the caller-supplied :length option when...

PT-2026-40570

Name of the Vulnerable Software and Affected Versions SveService versions prior to SMR May-2026 Release 1 Description An out-of-bounds write exists in SveService, which occurs when a program writes data past the end of the intended buffer. This allows local privileged attackers to execute arbitra...

CVE-2026-21821: Use of Unmaintained Third Party Components

The HCL BigFix SCM Reporting site contains an outdated and unsupported version of the jQuery 1.x library. Since jQuery 1.x has reached end-of-life and no longer receives security updates, it may expose the application to publicly known security weaknesses and increase the risk of client-side...

CVE-2026-44296

Deskflow is a keyboard and mouse sharing app. Prior to 1.26.0.167, a remote, unauthenticated denial of service DoS vulnerability affects Deskflow servers running with TLS enabled the default. When any TCP peer connects to the listening port and its first bytes do not parse as a valid TLS...

CVE-2026-42348 OpAMP client reads unbounded HTTP response bodies

OpenTelemetry.OpAmp.Client is the OpAMP client for OpenTelemetry .NET. Prior to 0.2.0-alpha.1, when receiving responses from the OpAMP server over HTTP, the OpAMP client allocates an unbounded buffer to read all bytes from the server, with no upper-bound on the number of bytes consumed. This coul...

CVE-2026-42348 OpAMP client reads unbounded HTTP response bodies

OpenTelemetry.OpAmp.Client is the OpAMP client for OpenTelemetry .NET. Prior to 0.2.0-alpha.1, when receiving responses from the OpAMP server over HTTP, the OpAMP client allocates an unbounded buffer to read all bytes from the server, with no upper-bound on the number of bytes consumed. This coul...

CVE-2026-42348

OpenTelemetry.OpAmp.Client (OpenTelemetry .NET) is affected before version 0.2.0-alpha.1. The HTTP transport reads HttpResponseMessage.Content into memory using ReadAsByteArrayAsync without a size cap, allowing an unbounded read of the entire response body. This can cause memory exhaustion in the...

CVE-2026-43991

JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, substring-based blocklist in plugin-shell's command-safety check could be bypassed by adversarial argument constructions, allowing unauthorized command execution on the host when combined with the companion...

CVE-2026-43992

JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, every MCP write tool sendtokens, executecontract, instantiatecontract, uploadwasm, ibctransfer, etc. accepted 'mnemonic: string' as an explicit tool-call parameter. The BIP-39 seed was consequently embedded in th...

CVE-2026-20794

Intel Data Center Graphics Driver for VMware ESXi prior to 2.0.2 contains a buffer overflow in Ring 1: Device Drivers that can allow a local privilege escalation. A system software adversary with a privileged user and low attack complexity could potentially execute code locally with no user inter...

EUVD-2026-29542

JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, the WAVS bridge's computeDataVerify called fetch on agent-supplied URLs without validating scheme, port, or resolved IP, resulting in an SSRF vulnerability. This vulnerability is fixed in 0.x.y-security-1...

EUVD-2026-29539

JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, plugin-shell's runcommand wrapped every agent-supplied command in 'sh -c' / 'cmd /C' and passed the full argument string to the shell's parser, allowing shell metacharacters in agent-supplied arguments to be...