361765 matches found
UBUNTU-CVE-2026-104030
A flaw was found in sssd. This vulnerability allows a local user to cause a Denial of Service DoS by submitting a specially crafted passkey authentication token that lacks null terminators. The authentication service reads past the end of the provided memory buffer, causing the process to crash a...
jf-langflow (>=1.10.0, <=1.10.0.post7), langflow-nightly (1.8.0.dev24) potentially affected by CVE-2026-105697 via langflow-base (>=0.7.2, <=0.10.0)
langflow-base PYPI version =0.7.2, =1.10.0, =1.10.0.post7 - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-105697 Source advisory: MEND:CVE-2026-105697...
CVE-2026-105642
Ghost is a Node.js content management system. From 6.56.0 until 6.67.0, an image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for an attacker-controlled website, resulting in arbitrary...
UBUNTU-CVE-2026-105326
An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot b...
sign-alex (1.0.1) potentially affected by CVE-2026-105676 via ghost (1.26.2)
ghost NPM version 1.26.2 is affected by a known vulnerability. The following packages have a transitive dependency on ghost and may be impacted: - sign-alex 1.0.1 Source cves: CVE-2026-105676 Source advisory: MEND:CVE-2026-105676...
CLSA-2026-1791226863 TuxCare security update for brace-expansion (1 CVE)
TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 5.0.8-tuxcare.2...
CLSA-2026-1791226763 TuxCare security update for brace-expansion (1 CVE)
TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 5.0.10-tuxcare.1...
CLSA-2026-1791226683 TuxCare security update for brace-expansion (1 CVE)
TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 5.0.11-tuxcare.1...
CLSA-2026-1791226583 TuxCare security update for brace-expansion (1 CVE)
TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 2.1.6-tuxcare.1...
CLSA-2026-1791226577 TuxCare security update for brace-expansion (1 CVE)
TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 5.0.4-tuxcare.1...
CLSA-2026-1791226379 TuxCare security update for brace-expansion (1 CVE)
TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 2.1.3-tuxcare.2...
CLSA-2026-1791225543 TuxCare security update for decompress (2 CVEs)
TuxCare rebuilt decompress to address 2 CVEs. Fixed in 4.2.1-tuxcare.1...
com.amazonaws.serverless:aws-serverless-java-container-struts (>=1.9, <=1.9.5), com.jgeppert.struts2.bootstrap:struts2-bootstrap-plugin (>=4.0.2, <=5.0.6) +79 more potentially affected by CVE-2026-104714 via org.apache.struts:struts2-core (>=6.0.0, <=6.11.0)
org.apache.struts:struts2-core MAVEN version =6.0.0, =1.9, =4.0.2, =4.0.2, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =1.4.0, =1.4.1, =1.4.0, =1.4.3 and more Source cves: CVE-2026-104714 Source advisory: MEND:CVE-2...
CVE-2026-104712 Apache Struts: Disproportionate response size when rendering BigDecimal request parameters
Asymmetric resource consumption amplification vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal java.math.BigDecimal property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude large...
CVE-2026-104712
Asymmetric resource consumption amplification vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal java.math.BigDecimal property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude large...
EUVD-2026-92623
Asymmetric resource consumption amplification vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal java.math.BigDecimal property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude large...
CVE-2026-105642 Ghost: Remote Code Execution via Bookmark Card Images
Ghost is a Node.js content management system. From 6.56.0 until 6.67.0, an image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for an attacker-controlled website, resulting in arbitrary...
CVE-2026-105642
Ghost is a Node.js content management system. From 6.56.0 until 6.67.0, an image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for an attacker-controlled website, resulting in arbitrary...
UBUNTU-CVE-2026-93317
An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The resulting snapshot could be cached under that digest and reused by a later victim build, compromising build-input integrity...