76083 matches found
ALSA-2026:66000 Important: kernel security update
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: crypto: pcrypt - Fix handling of MAYBACKLOG requests CVE-2026-43493 kernel: netfilter: conntrack: remove sprintf usage CVE-2026-53002 kernel: netfilter: synproxy: refresh tcphdr after...
PT-2026-88925
Name of the Vulnerable Software and Affected Versions Apache Parquet versions 1.12 through 1.18 Description The org.apache.parquet.crypto.keytools package allows for the encryption of Parquet files using an envelope encryption mechanism that wraps data keys via a Key Management Service KMS. When...
RHEL 10 : openssh (RHSA-2026:65900)
The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:65900 advisory. OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary...
EUVD-2026-75167
A divide-by-zero vulnerability in the gfdashgettimelineduration function src/mediatools/dashclient.c of GPAC v26.07.0 allows attackers to cause a Denial of Service DoS via a crafted MPD SegmentTimeline. Fixed in 2fd5a06ab226767900fd86edb5a1e8bfc1010640...
PT-2026-89146
A divide-by-zero vulnerability in the gf dash get timeline duration function src/media tools/dash client.c of GPAC v26.07.0 allows attackers to cause a Denial of Service DoS via a crafted MPD SegmentTimeline. Fixed in 2fd5a06ab226767900fd86edb5a1e8bfc1010640...
PT-2026-89193
Name of the Vulnerable Software and Affected Versions eKuiper versions prior to 2.4.0 Description A Server-side request forgery SSRF issue exists where the server does not validate destination IP addresses during external service registrations and HTTP invocations. An attacker with permissions to...
ROS-20260909-73-0057
The vulnerability of the Navigation component in Google Chrome and Microsoft Edge is related to the implementation of security features at the client-side. Exploiting this vulnerability can allow an attacker, operating remotely, to access confidential data through a specially created HTML page...
CVE-2026-74761: Improper Input Validation
Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable topic subscription. This issue affects Apache ActiveMQ Broker: before 5.19.11, from 6.0.0 before 6.3.2;...
PT-2026-88940
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Restriction of Excessive Authentication Attempts vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading ...
CVE-2026-79513
A divide-by-zero vulnerability in the gfdashgettimelineduration function src/mediatools/dashclient.c of GPAC v26.07.0 allows attackers to cause a Denial of Service DoS via a crafted MPD SegmentTimeline. Fixed in 2fd5a06ab226767900fd86edb5a1e8bfc1010640...
SUSE CVE-2026-85024
undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit. When a remote peer sends a compressed payload that crosses the built-in 128 MiB...
ai.koog:agents-mcp (>=0.4.2, <=1.3.0-beta), ai.koog:koog-agents (>=0.4.2, <=0.7.3) +11 more potentially affected by CVE-2026-53937 via io.modelcontextprotocol:kotlin-sdk-client (>=0.7.0, <=0.12.0)
io.modelcontextprotocol:kotlin-sdk-client MAVEN version =0.7.0, =0.4.2, =0.4.2, =1.0.0-beta, =0.4.2, =0.1.0, =0.7.0, =0.0.3, =0.0.9 Source cves: CVE-2026-53937 Source advisory: MEND:CVE-2026-53937...
CVE-2026-86075
n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the OAuth Dynamic Client Registration endpoint bounded redirecturis but accepted arbitrarily large clientname and granttypes values. An unauthenticated remote caller could repeatedly persist oversized values in...
firefox: Privilege escalation in the Remote Settings Client component
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the Remote Settings Client component...
CVE-2026-86075 n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint
n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the OAuth Dynamic Client Registration endpoint bounded redirecturis but accepted arbitrarily large clientname and granttypes values. An unauthenticated remote caller could repeatedly persist oversized values in...
EUVD-2026-67209
mongodb: Reject "." and NUL bytes in database and collection names...
GHSA-RVX4-FFVW-M9Q3 Composer arbitrary command execution via a malicious package's Perforce source URL
Summary If the p4 Perforce CLI client is installed, a malicious dependency package from a package repository allowing arbitrary perforce source URLs packagist.org is safe could execute arbitrary commands when running composer install or composer update. Composer passed a package's Perforce source...
CVE-2026-78635
The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arguments. When a scaleft:// protocol handler link contains a value beginning with a hyphen, the underlying CLI framework interprets it as a command-line flag,...