CVE-2026-89317

gose parsed the JWS "crit" header into "JwsHeader.Crit" and then never read it. RFC 7515 §4.1.11 requires a recipient to reject a JWS whose listed critical extension parameters it does not understand. gose implements no header extensions, so every token carrying a non-empty "crit" should have bee...

EUVD-2026-108633

JwksTrustStore.Get assigned each parsed key to the function's named return value while refreshing the JWKS cache. When the requested kid was not present, the trailing naked return handed the caller the last key in the JWKS document together with a nil error — a confidently wrong answer instead of...

Pillow: Reachable Undefined Behavior In Native Integer Operations, Potentially Leading To Denial Of Service Or Logic Int

Summary Affected Object and Source Package: Pillow 12.3.0 Source: PyPI sdist pillow-12.3.0.tar.gz SHA-256: 3b8182a766685eaa002637e28b4ec8d6b18819a0c71f579bf0dbaa5830297cce Sink: src/imaging.c:2809:15, xsize += dx Details The code in Pillow 12.3.0 is: for xsize = 0; text; text++ int dx =...

Important: Red Hat Security Advisory: php:7.4 security update

An update for the php:7.4 module is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability...

Chromium CVE-2026-113239: Range error

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Important: Red Hat Security Advisory: php:7.4 security update

An update for the php:7.4 module is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

php: fatal error handling retains stale request state leading to use-after-free

A flaw was found in PHP's error handling and worker process state management. PHP contains error handling, object, and extension state that is retained by the process but points to memory owned by a single request. A fatal error can interrupt an operation or cleanup phase before that state is...

CLEANSTART-2026-DB41831 Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer

CVE-2026-56851 affects multiple packages. The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer. See references for individual vulnerability details...

OpenWRT odhcpd buffer error vulnerability

OpenWRT odhcpd versions 25.12 and earlier contain a buffer error vulnerability. This vulnerability arises because DHCPv6 self-loop detection directly uses the network byte-order length value of the DUID as the argument to memcmp at dhcpv6.c:720. On little-endian hosts, this may result in reading...

Node.js Node processing logic error vulnerability

Node.js versions 26.12.0 and earlier contain a processing logic error vulnerability. This vulnerability arises because the zlib.ZipFile API fails to validate local headers and central directory headers locally; as a result, it caches the parsed local header without setting a content offset...

PT-2026-121817

JweDirectDecryptorBlock.Decrypt read a 64-bit plaintext length from the thales aad protected-header field and used it without any validation. A truncated field panics binary.BigEndian.Uint64, an oversized value drives an unbounded allocation, and a value larger than the decrypted block panics wit...

OpenStack Ironic resource management error vulnerability

Versions 30.0.0 through 32.1.1, 33.0.0 through 35.1.1, and 36.0.0 through 39.0.1 of OpenStack Ironic contain a resource management error vulnerability. This vulnerability arises because configdrive can lead to the inclusion of large amounts of uncompressed data i.e., gzip bombs, potentially...

Red Hat Enterprise Linux buffer error vulnerability

Red Hat Enterprise Linux versions 7, 8, 9, and 10 contain a buffer error vulnerability. This vulnerability stems from improper calculation of option data length by the DHCPv4 option parser within the iscsiuio component. As a result, data exceeding the allocated buffer is read into adjacent heap...

baserproject baserCMS input validation error vulnerability

In versions prior to 5.3.2 of baserproject baserCMS, there is an input validation error vulnerability. This vulnerability arises because unauthenticated visitors can provide comma-separated address lists in the email field of public mail forms; the system fails to adequately validate this input. ...

Pypdf resource management error vulnerability

Versions of pypdf prior to 6.21.2 contain a resource management error vulnerability. This vulnerability stems from incomplete handling of duplicate malformed cross-reference entries; even when recovery caching is available, each recovery attempt triggers a full reload of the PDF stream. As a...

Red Hat: CVE-2026-98876: kernel: host1x: bus: Fix missing ops null check in error teardown

In the Linux kernel, the following vulnerability has been resolved: host1x: bus: Fix missing ops null check in error teardown In host1xdeviceinit, the error teardown paths do not check client-ops before dereferencing it, unlike the forward init paths which correctly guard with 'client-ops &&'. Th...

Pypdf resource management error vulnerability

Versions of pypdf prior to 6.21.2 contain a resource management error vulnerability. This vulnerability arises when an attacker can craft a specially formatted PDF containing a standard cross-reference table with a claimed number of entries exceeding what the file can actually hold. As a result,...

Twisted resource management error vulnerability

Versions of Twisted prior to 26.10.0rc1 contain a resource management error vulnerability. This vulnerability arises because when processing authenticated SEARCH commands, twisted.mail.imap4.IMAP4Server passes a negative literal size to parseNestedParens. As a result, the parser’s cursor moves...

Qt resource management error vulnerability

Qt has a resource management error vulnerability stemming from HTTP/2 client support allowing post-free reuse. This may cause client applications running on malicious or compromised HTTP/2 servers to crash, thereby affecting availability...

Mervin Praison PraisonAI processing logic error vulnerability

A security vulnerability exists in Mervin Praison PraisonAI versions from 4.5.87 up to and including 4.6.59. This vulnerability arises because the recipe.runstream stream execution path fails to perform checks on dangerous tools, allowing recipes declared as executecommand to bypass restrictions ...