GHSA-QPGP-93VX-G8V8 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips...

CVE-2026-11837

creationtimestamp| type| source ---|---|--- 2026-06-10 06:00:45+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mnvzvhfhhz25 2026-06-10 06:00:51+00:00| seen| https://infosec.exchange/users/offseq/statuses/116724284473192022...

MGASA-2026-0190 Updated golang-x-net packages fix security vulnerability

CVE-2024-45338 An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...

Updated golang-x-net packages fix security vulnerability

CVE-2024-45338 An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...

MGASA-2026-0186 Updated libxpm packages fix security vulnerability

libXpm Out-of-bounds read in xpmNextWord. CVE-2026-4367...

CVE-2025-59382

creationtimestamp| type| source ---|---|--- 2026-06-10 05:02:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnvwmmlkfz2h...

CVE-2025-66280

An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the...

EUVD-2025-210101

An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the...

CVE-2026-11645 vulnerabilities

Vulnerabilities for packages: chromium...

EUVD-2025-210095

QTS, QuTS hero, QuTScloud are not affected. We have already fixed the vulnerability in the following version:...

CVE-2026-53675

creationtimestamp| type| source ---|---|--- 2026-06-10 01:32:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnvkuvwacd2m...

CVE-2026-45782

creationtimestamp| type| source ---|---|--- 2026-06-10 01:07:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnvjj7zznp2v...

CVE-2026-46517

creationtimestamp| type| source ---|---|--- 2026-06-10 00:53:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnviqw426o23 2026-06-10 02:00:32+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnvmhu5mqf2g 2026-06-10 02:40:58+00:00| seen|...

EUVD-2026-35919

ESF-IDF is the Espressif Internet of Things IOT Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.3, and 6.0, an out-of-bounds read exists in the BlueDroid AVRCP vendor-command parser avrcparsvendorcmd in components/bt/host/bluedroid/stack/avrc/avrcparstg.c. This issue has been patched ...

CVE-2026-41728

Spring Data REST's JSON Patch application/json-patch+json implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0...

CVE-2026-40991

When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next execute...

CVE-2026-41701

CVE-2026-41701 affects Spring AMQP (RabbitTemplate) where correlation IDs for replies on fixed reply queues are generated by an internal simple counter, making them predictable. This data from NVD/CVE listings confirms the issue affects multiple versions (2.4.0–2.4.17, 3.1.0–3.1.15, 3.2.0–3.2.10,...

EUVD-2026-35873

LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, LMDeploy is vulnerable to arbitrary code execution through hardcoded "trustremotecode=True" in multiple HuggingFace model-loading call sites. At time of publication, there are no...

CVE-2026-46490

samlify is a Node.js library for SAML single sign-on. Prior to version 2.13.0, samlify’s template substitution only escapes attribute contexts. Values inserted into element text e.g., are not escaped. A normal user can inject XML markup into an attribute value e.g., email, name and add new elemen...

GHSA-46Q3-7GV7-QMGG Net::IMAP: Command Injection via ID command argument

Summary Two Net::IMAP commands, id and enable, do not validate their arguments. Arguments to either command could be used by an attacker to inject arbitrary IMAP commands. Please note that passing untrusted inputs to these commands is usually inappropriate and expected to be uncommon. Details Whe...