CVE-2026-29054

A flaw was found in Traefik, an HTTP reverse proxy and load balancer. A remote unauthenticated client can exploit a case sensitivity vulnerability in how Traefik processes HTTP/1.1 requests. By using lowercase tokens in the Connection header, an attacker can bypass security protections, leading t...

CVE-2025-14009

A code execution vector has been discovered in the python NTLK library. The unzipiter function in nltk/downloader.py uses zipfile.extractall without performing path validation or security checks. This allows attackers to craft malicious zip packages that, when downloaded and extracted by NLTK, ca...

CVE-2026-2391

A denial of service flaw has been discovered in the qs npm package. When the comma option is set to true not the default, but configurable in applications, qs allows parsing comma-separated strings as arrays e.g., ?param=a,b,c becomes 'a', 'b', 'c'. However, the limit check for arrayLimit default...

CVE-2025-68428

jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal. If given the possibility to pass unsanitized paths to the loadFile method, a user can retrieve file...

CVE-2025-66552

Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1, incorrect path handling with groupfolders caused the adminaudit app to not properly log all actions on files and folders inside groupfolders. This vulnerability is fixed ...

CVE-2025-59148

Suricata is a network IDS, IPS and NSM engine developed by the OISF Open Information Security Foundation and the Suricata community. Versions 8.0.0 and below incorrectly handle the entropy keyword when not anchored to a "sticky" buffer, which can lead to a segmentation fault. This issue is fixed ...

CVE-2025-8715

A flaw was found in PostgreSQL. This vulnerability allows a malicious user of the PostgreSQL server to inject arbitrary code in dump files created by pgdump, pgdumpall, pgrestore, and pgupgrade, causing arbitrary code execution on the client machine or SQL injection when these dump files are...

CVE-2025-54119

A flaw was found in php-adodb. Improper escaping of query parameters allows an attacker to execute arbitrary SQL statements. A remote attacker can leverage this vulnerability by crafting a malicious query. This issue can lead to unauthorized data access or modification. Mitigation Mitigation for...

CVE-2025-7656

An integer overflow flaw was found in Chromium. This vulnerability allows a remote attacker to cause heap corruption via a crafted HTML page, potentially leading to unpredictable behavior, such as system crashes and the execution of malicious code. Mitigation Mitigation for this issue is either n...

CVE-2025-6663

A stack based buffer overflow was found in the GStreamer media handling library. This flaw allows an attacker who is able to feed in a maliciously constructed H266 file to execute arbitrary code in the context of the process running GStreamer. Mitigation Mitigation for this issue is either not...

CVE-2025-5472

A denial of service flaw was found in llamaindex. The JSONReader class does not properly handle deeply nested JSON data structures and may throw a RecursionError given certain data input. If left uncaught, this may cause the program to crash. Mitigation Mitigation for this issue is either not...

CVE-2024-46992

A flaw was found in Electron. The vulnerability stems from improper handling of ASAR Archive files, allowing a local attacker to manipulate archive contents without proper integrity verification. This issue can lead to arbitrary code execution within the application's context via a crafted ASAR...

CVE-2024-11584

A default permissions flaw was found in cloud-init. The cloud-init-hotplugd.socket grants 0666 permissions, making it world-writable. This vulnerability allows an unprivileged user to trigger hotplug-hook commands. Mitigation Mitigation for this issue is either not available or the currently...

CVE-2025-40908

A flaw was found in yaml-libyaml. The component uses a two-argument open function when parsing YAML files, which allows an attacker to modify existing files on the system. This flaw allows a local attacker to provide a crafted YAML file as input. This issue can result in unauthorized modification...

CVE-2025-46687

quickjs-ng through 0.9.0 has a missing length check in JSReadString for a string, leading to a heap-based buffer overflow. QuickJS before 2025-04-26 is also affected. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product...

CVE-2025-31344

A flaw was found in the gif2rgb utility of giflib. This vulnerability allows an attacker to cause a heap-based buffer overflow via crafted GIF files. The issue arises due to improper handling of certain GIF image data, leading to memory corruption.​ Mitigation Mitigation for this issue is either...

CVE-2025-32395

A flaw was found in Vite. This vulnerability allows arbitrary file access via specially crafted HTTP requests containing a character in the request URL. The issue occurs when the server is run on Node.js or Bun and exposed to the network. Improper handling of invalid request lines allows these...

CVE-2025-29915

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. The AFPACKET defrag option is enabled by default and allows AFPACKET to re-assemble fragmented packets before reaching Suricata. However the default packet size in Suricata is bas...

CVE-2025-3122

A NULL pointer write vulnerability was found in the wabt::interp::anonymous namespace::BinaryReaderInterp::BeginFunctionBody function within glslang. This issue occurs when processing certain files, leading to a potential application crash. Mitigation Mitigation for this issue is either not...

CVE-2025-1219

A flaw was found in PHP's DOM and SimpleXML extensions. This vulnerability allows incorrect parsing of a redirected HTTP resource via improper content-type header handling. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat...