CVE-2026-67918

Directory Traversal vulnerability in hermes-studio v.0.6.26 allows a remote attacker to obtain sensitive information via the validatePath function in api/hermes/download endpoint...

ANT-2026-B615AQ9E · exim · off-by-one

off-by-one medium CVE-2026-40685 Severity Claude high · Security research firm high · Maintainer medium Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Calif. ANT-2026-B615AQ9E: Exim dewrap Off-By-One OOB Read → Co...

ANT-2026-A5580GNM · xdao · logic-error

logic-error WITHDRAWN This report was withdrawn after publication. The original commitment below remains in the ledger, and the identifying fields published before the withdrawal are kept as they were first published. Note, 2026-10-02. This page showed the full report from 2026-08-26 until...

ANT-2026-ZYEZKB5Y · OpenSC · Stack Buffer Overflow

stack-buffer-overflow medium Severity Claude medium · Security research firm medium · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-ZYEZKB5Y: Stack buffer overflow in...

CVE-2026-45698 Netatalk has Integer Underflow → Stack Buffer Overflow in deletedir()

Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the deletedir function of Netatalk's afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for pat...

CVE-2026-72045

A flaw was found in the Linux kernel component octeontx2-af. A local attacker with access to a Virtual Function VF could exploit an unsanitized input in the rvumboxhandlerlmtsttblsetup function. This vulnerability allows the VF to read the physical base address of another function's LMTLINE, whic...

ANT-2026-C6E98TYX · liboqs · Uninitialized Function Pointer (CWE-824)

other high Severity Claude high · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics. ANT-2026-C6E98TYX: 01-liboqs-ntru-uninit-fn-ptr The NTRU constructors in...

ANT-2026-MAPZGQDY · jsoncons · Heap-buffer-overflow

heap-buffer-overflow high Severity Claude high · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics. ANT-2026-MAPZGQDY: Heap-buffer-overflow in bigint.hpp:260 Duri...

CVE-2026-71491 sqlparse: Quadratic O(n²) DoS in group_comments

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, groupcomments in sqlparse/engine/grouping.py repeatedly rescans comment-only statements before the MAXGROUPINGTOKENS guard, causing quadratic CPU consumption through sqlparse.parse and sqlparse.formatsql, stripcomments=Tru...

CVE-2026-71491

sqlparse (Python SQL parser) prior to 0.6.0 is vulnerable to a quadratic CPU DoS in group_comments (sqlparse/engine/grouping.py). A comment-only statement (e.g., '-- c\n' * n) causes the function to rescan all remaining tokens per iteration, yielding O(n²) behavior. Critically, this runs before t...

CVE-2026-73424 Astro: Unauthenticated path override in the @astrojs/vercel ISR function

Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel adapter in packages/integrations/vercel/src/serverless/entrypoint.ts accepts xastropath for the public /isr function based only on the x-vercel-isr header, allowing unauthenticated GET requests to...

CVE-2026-73424 Astro: Unauthenticated path override in the @astrojs/vercel ISR function

Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel adapter in packages/integrations/vercel/src/serverless/entrypoint.ts accepts xastropath for the public /isr function based only on the x-vercel-isr header, allowing unauthenticated GET requests to...

CVE-2026-73424 Astro: Unauthenticated path override in the @astrojs/vercel ISR function

Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel adapter in packages/integrations/vercel/src/serverless/entrypoint.ts accepts xastropath for the public /isr function based only on the x-vercel-isr header, allowing unauthenticated GET requests to...

CVE-2026-73424

The Astro Vercel adapter (10.0.3–11.0.2) in entrypoint.ts trusts the x_astro_path header for the /_isr function based only on x-vercel-isr, letting unauthenticated GET requests render routes protected only by Vercel edge path rules or split edge middleware. CVSS 6.5 MEDIUM (AV:N/AC:L/PR:N/UI:N/S:...

SUSE CVE-2026-64952

The huntdelete VQL function allows deleting hunts. Velociraptor misapplied the permission check requiring only COLLECTCLIENT usually assigned to the "investigator" role instead of the "DELETERESULTS" permission usually only assigned to "administrators"...

CVE-2026-45699

A flaw was found in Netatalk. An integer underflow vulnerability exists in the copydir function of the afpd daemon. This flaw occurs when a file operation crosses a device boundary within an Apple Filing Protocol AFP shared volume. Incorrect calculation of buffer size can lead to a stack-based...

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

A flaw was found in the brace-expansion library. The expand function does not apply maxLength when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is...

brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function

A flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand function, which can lead to excessive memory consumption. This can cause a denial of service DoS by crashing the application due to an out-of-memory error...

CVE-2026-74538

A flaw was found in the Linux kernel's Bluetooth ISO Isochronous Stream subsystem. A missing lock when accessing socket connection information within the isoconnectind function could lead to a null pointer dereference. This vulnerability could allow a local attacker to cause a system crash,...

brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function

A flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand function, which can lead to excessive memory consumption. This can cause a denial of service DoS by crashing the application due to an out-of-memory error...