363332 matches found
CVE-2026-66858: Uncontrolled Recursion
The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator the pure-Python protocols are not affected, the PHP library and its...
PT-2026-104324
Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description The protocol skip routine in several Apache Thrift bindings fails to apply the recursion limit. This allows a message containing deeply nested unknown fields to exhaust the stack, potentially...
UBUNTU-CVE-2026-61812
GHSA-cxqf-vgrr-xxrv: HTML decoder missing entities, leading to evasion...
21millionpixels-mcp (>=0.2.0, <=0.2.1), @0xkillaflow/agama-redmine-mcp (>=1.0.0, <=2.1.0) +5179 more potentially affected by unknown CVE via @modelcontextprotocol/sdk (>=1.24.0, <=1.31.0)
@modelcontextprotocol/sdk NPM version =1.24.0, =0.2.0, =1.0.0, =0.1.3, =0.1.0, =0.1.0, =0.2.0, =0.38.0, =1.0.0, =8.0.0, =0.14.0, =0.1.0, =0.2.0, =0.7.0, =1.0.2 and more Source cves: unknown CVE Source advisory: MEND:WS-2026-0090...
mako TemplateLookup Function Unauthenticated Access
The vulnerability of the TemplateLookup.gettemplate function in the mako/lookup.py file of the Sqlalchemy mako template library in Python is related to an incorrect path name limitation for accessing restricted directories. Exploiting this vulnerability could allow an attacker to gain unauthorize...
CLSA-2026-1790893546 TuxCare security update for fast-uri (1 CVE)
TuxCare rebuilt fast-uri to address 1 CVE. Fixed in 3.1.2-tuxcare.3...
CLSA-2026-1790890883 TuxCare security update for ip-address (3 CVEs)
TuxCare rebuilt ip-address to address 3 CVEs. Fixed in 7.1.0-tuxcare.4...
CLSA-2026-1790889495 TuxCare security update for fastify (1 CVE)
TuxCare rebuilt fastify to address 1 CVE. Fixed in 5.2.1-tuxcare.3...
CLSA-2026-1790889438 TuxCare security update for axios (2 CVEs)
TuxCare rebuilt axios to address 2 CVEs. Fixed in 0.33.0-tuxcare.4...
awsidr (>=1.0.0, <=1.0.9), rds-proxy-password-rotation (>=0.5.8, <=0.6.556) potentially affected by CVE-2026-104002 via aws-lambda-powertools (>=3.7.0, <=3.34.0)
aws-lambda-powertools PYPI version =3.7.0, =1.0.0, =0.5.8, =0.6.556 Source cves: CVE-2026-104002 Source advisory: MEND:CVE-2026-104002...
CLSA-2026-1790888307 TuxCare security update for piscina (1 CVE)
TuxCare rebuilt piscina to address 1 CVE. Fixed in 4.8.0-tuxcare.1...
CLSA-2026-1790888294 TuxCare security update for brace-expansion (1 CVE)
TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 1.1.16-tuxcare.3...
CLSA-2026-1790888237 TuxCare security update for devalue (1 CVE)
TuxCare rebuilt devalue to address 1 CVE. Fixed in 5.9.0-tuxcare.1...
CLSA-2026-1790888210 TuxCare security update for devalue (5 CVEs)
TuxCare rebuilt devalue to address 5 CVEs. Fixed in 5.9.2-tuxcare.1...
GO-2026-6579 OpenBao Skips Stricter Deny Policy for LIST operations in github.com/openbao/openbao
OpenBao Skips Stricter Deny Policy for LIST operations in github.com/openbao/openbao...
GO-2026-6554 OpenBao Agent Writes Secrets to Stdout in github.com/openbao/openbao
OpenBao Agent Writes Secrets to Stdout in github.com/openbao/openbao...
CVE-2026-53964
Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Prior to version 9.1.0, a remote code execution RCE via server-side template injection SSTI allows for user supplied code to be executed in the server's context where i...
CVE-2026-55251
NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to commit f41fc1e, the CI workflow .github/workflows/validation.yml runs on pullrequest and executes code supplied by the pull request before any maintainer review. Three...
0beny1s (1.1.6), 0x404 (1.1.4) +14310 more potentially affected by CVE-2026-104182 via stream-json (>=0.4.2, <=3.5.0)
stream-json NPM version =0.4.2, =0.0.2, =0.0.7, =0.0.0-20251106131028, =0.0.2, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.10 and more Source cves: CVE-2026-104182 Source advisory: MEND:CVE-2026-104182...
CVE-2026-53964 Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)
Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Prior to version 9.1.0, a remote code execution RCE via server-side template injection SSTI allows for user supplied code to be executed in the server's context where i...