SUSE CVE-2026-73051

actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: chunked headers. Unauthenticated remote attackers can exploit this through a front-end intermediary to desynchronize backe...

PT-2026-77151

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdown plugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom link synta...

CVE-2026-50126: Out-of-bounds Read

Adaguc-server is an open source geographical information system to visualize, combine, compare and share real-time meteorological, climatological and remote sensing data via OGC standards. Versions prior to 7.2.2 crash with a memory-safety fault when it parses a GeoJSON document whose geometry...

CVE-2026-55839: Improper Neutralization of Input During Web Page Generation

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdownplugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom link syntax...

Linux Distros Unpatched Vulnerability : CVE-2026-15803

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity XXE processing when parsing untrusted XML-based RDF data or query...

PT-2026-77207

Adaguc-server is an open source geographical information system to visualize, combine, compare and share real-time meteorological, climatological and remote sensing data via OGC standards. Versions prior to 7.2.2 crash with a memory-safety fault when it parses a GeoJSON document whose geometry...

Linux Distros Unpatched Vulnerability : CVE-2026-72374

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - afs: Fix callback service message parsers to pass through -EAGAIN The AFS filesystem client uses an rxrpc server to listen for callback notifications. Each...

Amazon Linux 2023 : jackson-core (ALAS2023-2026-2067)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2067 advisory. The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit...

Amazon Linux 2023 : javapackages-bootstrap (ALAS2023-2026-2055)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2055 advisory. Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core 5.4.2 and earlier, 5.5-beta1 and earlier allows an remote attacker to cause a denial of...

AlmaLinux 10 : gstreamer1-plugins-good (ALSA-2026:55434)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55434 advisory. gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux FUJIFILM strd parsing leading to out-of-bounds read/write CVE-2026-73433...

Linux Distros Unpatched Vulnerability : CVE-2026-72300

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ASoC: SOF: topology: validate vendor array size before parsing sofparsetokensets reads array-size while iterating over topology private data. The loop condition...

NanaZip 6.5 - DoS

Exploit Title: NanaZip 6.5 - DoS Date: 2026-07-17 Exploit Author: Pig-Tail Jorge González Milla Vendor Homepage: https://github.com/M2Team/NanaZip Software Link: https://github.com/M2Team/NanaZip/releases Version: NanaZip 3 GiB. All superb...

ANT-2026-TNDDD6NW · ffmpeg · Stack Buffer Overflow

stack-buffer-overflow high Severity Claude high · Security research firm - · Maintainer - REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-TNDDD6NW: Stack buffer overflow in mpegts.c pmtcb via multiple IOD The MPEG-TS PMT parser in libavformat/mpegts.c allocates a fixed...

ANT-2026-09SNWQBT · libredwg · Use-after-free

use-after-free critical Severity Claude critical · Security research firm critical · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics. ANT-2026-09SNWQBT: Use-after-free in libredwg In...

CVE-2026-74234

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

DEBIAN-CVE-2026-68005

An issue in ACME minihttpd 1.30 and prior allows a remote attacker to cause a denial of service via the HTTP request header parser in the handlerequest function...

ANT-2026-KRKYEBGE · nftables · write-primitive

other high Severity Claude high · Security research firm high · Maintainer - Discovered by Claude Opus 4.6 REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-KRKYEBGE: write-primitive in nftables In jsonparsemapstmt, the parser...

CVE-2026-74234

Legora before 2026-08-14 contains a cross-site scripting vulnerability that allows attackers to achieve arbitrary JavaScript execution in a victim's browser by embedding a Mermaid block prefixed with a gray-matter JavaScript front-matter directive, causing the front-matter parser to invoke eval...

EUVD-2026-60437

Legora before 2026-08-14 contains a cross-site scripting vulnerability that allows attackers to achieve arbitrary JavaScript execution in a victim's browser by embedding a Mermaid block prefixed with a gray-matter JavaScript front-matter directive, causing the front-matter parser to invoke eval...

CVE-2026-71491

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, groupcomments in sqlparse/engine/grouping.py repeatedly rescans comment-only statements before the MAXGROUPINGTOKENS guard, causing quadratic CPU consumption through sqlparse.parse and sqlparse.formatsql, stripcomments=Tru...