DEBIAN-CVE-2026-84269

A flaw was found in the AFP backend in gvfs. When mounting a share, a malicious AFP server can cause the DSI read path to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the pre-sized reply buffer, causing the operati...

CVE-2026-84268

A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause readreply to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing...

CVE-2026-84270

A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, doread in gvfsbackendmtp.c trusts the data length returned by the device without limiting it to the original size requested by the client. If a malicious MTP device responds with more bytes than requested,...

CVE-2026-49329

A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only '-'...

github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

A flaw was found in Go JOSE, a library for handling JSON Web Encryption JWE objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.20.36 packages and security update

Red Hat OpenShift Container Platform release 4.20.36 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.20. Red Hat Product Security has rated this update as having a...

wget: GNU Wget: Heap buffer overflow via server-supplied filename leads to memory corruption

A flaw was found in GNU Wget. A remote attacker can exploit a heap buffer overflow vulnerability in the convertfname function. This occurs when processing a server-supplied filename that requires character set conversion, leading to memory corruption due to incorrect buffer reallocation. This can...

wget: GNU Wget: Arbitrary code execution or denial of service via crafted HTML attribute

A flaw was found in GNU Wget. A remote attacker can exploit a heap buffer overflow vulnerability in the htmlquotestring function by providing a specially crafted HTML attribute. This can lead to memory corruption and potentially result in arbitrary code execution or a denial of service...

Moderate: Red Hat Security Advisory: wget security, bug fix, and enhancement update

An update for wget is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

OPENSUSE-SU-2026:21721-1 Security update for c-ares

This update for c-ares fixes the following issues: Updat to c-ares 1.36.8. - CVE-2026-33630: remotely triggerable use-after-free/double-free in query-completion handling via aresgetaddrinfo over TCP bsc1270416. - CVE-2026-69184: CPU exhaustion denial of service via unbounded DNS name compression...

CVE-2026-83615

A flaw was found in xmldom, a JavaScript library for parsing XML documents. A remote attacker could exploit this vulnerability by providing a specially crafted XML document. When processed, this document would cause the library to consume an excessive amount of memory, leading to the application...

CVE-2026-83614

A flaw was found in xmldom. Two independent quadratic paths in the XML DOM Document Object Model parser can lead to a denial of service DoS. A remote attacker could exploit this by providing specially crafted XML input, causing the parser to repeatedly rescan malformed tag names or reindex and...

CVE-2026-83613

A flaw was found in xmldom, a JavaScript module for parsing XML Extensible Markup Language documents. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing an element with numerous distinct attributes. The way xmldom processes these attributes...

CVE-2026-83612

A flaw was found in xmldom, a JavaScript module used for parsing HTML documents. This vulnerability allows a remote attacker to craft a malicious HTML document with specific mixed-case closing tags. When processed, this document can cause the parser to consume excessive CPU and memory, leading to...

Important: Red Hat Security Advisory: postgresql security update

An update for postgresql is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

postgresql: PostgreSQL: Denial of Service via uncontrolled recursion in SSL/GSS negotiation

A flaw was found in PostgreSQL. Uncontrolled recursion during SSL Secure Sockets Layer and GSS Generic Security Service negotiation allows an attacker to achieve a sustained denial of service. This can be exploited by an attacker with access to a PostgreSQL AFUNIX socket. If SSL and GSS are both...

Important: Red Hat Security Advisory: postgresql security update

An update for postgresql is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

postgresql: PostgreSQL: Denial of Service via uncontrolled recursion in SSL/GSS negotiation

A flaw was found in PostgreSQL. Uncontrolled recursion during SSL Secure Sockets Layer and GSS Generic Security Service negotiation allows an attacker to achieve a sustained denial of service. This can be exploited by an attacker with access to a PostgreSQL AFUNIX socket. If SSL and GSS are both...

CVE-2026-83606

A flaw was found in xmldom, a JavaScript XML DOM parser. This vulnerability, a Regular Expression Denial of Service ReDoS, occurs due to inefficient processing of unterminated processing instructions in XML input. A remote, unauthenticated attacker can send a specially crafted XML input, causing...

EUVD-2026-69301

A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only '-'...