CVE-2026-19484: Loop with Unreachable Exit Condition

@fastify/busboy is a multipart form-data parser. In versions 3.1.0 through 3.2.0, a remote unauthenticated attacker can stall the Node.js event loop by sending a multipart request whose boundary is crafted to a specific length. The vendored streaming search stores its skip table in a fixed 256...

PT-2026-80522

A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip insight whitespace function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by an HTTP server...

CVE-2025-59324

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to properly validate LUKS encryption and, if encryption is present, all CryptoPro file integrity checks are skipped...

PT-2026-71075

Name of the Vulnerable Software and Affected Versions CryptoPro Secure Disk for Bitlocker versions prior to 7.7.4 Description The bootxsa.efi component fails to properly validate LUKS Linux Unified Key Setup encryption. When encryption is detected, the system skips all CryptoPro file integrity...

CVE-2025-59327

In CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4, bootxsa.efi fails to properly validate LUKS encryption and, if encryption is present, all CryptoPro file integrity checks are skipped...

PT-2026-69788

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the smb3 simple fallocate range function where the system may skip holes when an allocated range returned by the server starts before the current fallocate offset. Thi...

SUSE CVE-2026-64590

In the Linux kernel, the following vulnerability has been resolved: dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning When CONFIGDMAAPIDEBUGSG is enabled, importing a udmabuf into a DRM driver e.g. amdgpu for video playback in GNOME Videos / Showtime triggers a spurious...

CVE-2026-5856

Contiki-NG's DNS/mDNS resolver skipname in os/services/resolv/resolv.c walks DNS wire-format name labels with no packet-boundary check, and the caller in newdata invokes it in a loop iterating nquestions times from the attacker-controlled DNS header before validating the transaction ID. An attack...

CVE-2026-5856 Contiki-NG DNS/mDNS Resolver Out-of-Bounds Read via Unchecked skip_name Traversal Before Transaction-ID Validation

Contiki-NG's DNS/mDNS resolver skipname in os/services/resolv/resolv.c walks DNS wire-format name labels with no packet-boundary check, and the caller in newdata invokes it in a loop iterating nquestions times from the attacker-controlled DNS header before validating the transaction ID. An attack...

CVE-2026-5856 Contiki-NG DNS/mDNS Resolver Out-of-Bounds Read via Unchecked skip_name Traversal Before Transaction-ID Validation

Contiki-NG's DNS/mDNS resolver skipname in os/services/resolv/resolv.c walks DNS wire-format name labels with no packet-boundary check, and the caller in newdata invokes it in a loop iterating nquestions times from the attacker-controlled DNS header before validating the transaction ID. An attack...

CVE-2026-5856

Affected software/component: Contiki-NG DNS/mDNS resolver (os/services/resolv/resolv.c). Root cause: skip_name() walks DNS wire-format labels without a packet-boundary check; newdata() loops nquestions from attacker-controlled DNS header before validating the transaction ID, causing the function ...

CVE-2026-64590

In the Linux kernel, the following vulnerability has been resolved: dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning When CONFIGDMAAPIDEBUGSG is enabled, importing a udmabuf into a DRM driver e.g. amdgpu for video playback in GNOME Videos / Showtime triggers a spurious...

CVE-2026-64590

The CVE-2026-64590 entry concerns the Linux kernel dma-buf/udmabuf path where, with CONFIG_DMA_API_DEBUG_SG enabled, importing udmabuf into a DRM driver (e.g., amdgpu) could emit a spurious cacheline EEXIST warning due to overlapping per-page SG mappings. The fix is to pass DMA_ATTR_SKIP_CPU_SYNC...

CVE-2026-49331

A flaw was found in openshift/oauth-proxy. On paths configured to bypass authentication skip-auth-regex, the proxy forwards client-supplied identity headers X-Forwarded-User, X-Forwarded-Email, X-Forwarded-Access-Token to the upstream application without stripping them. An unauthenticated attacke...

EUVD-2026-53393

A flaw was found in openshift/oauth-proxy. On paths configured to bypass authentication skip-auth-regex, the proxy forwards client-supplied identity headers X-Forwarded-User, X-Forwarded-Email, X-Forwarded-Access-Token to the upstream application without stripping them. An unauthenticated attacke...

CVE-2026-49331

A flaw was found in openshift/oauth-proxy. On paths configured to bypass authentication skip-auth-regex, the proxy forwards client-supplied identity headers X-Forwarded-User, X-Forwarded-Email, X-Forwarded-Access-Token to the upstream application without stripping them. An unauthenticated attacke...

Malicious code in twork-data-services-eacq-company-service-v2-api-v1-identifiers-crm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a35dfc30f1440b5057988bc44c6bdaecee3c33317799c140354ed7adae679838 index.js unconditionally requires setup.js on module load. setup.js reconstructs C2 hostnames at runtime from split string fragments resolving to...

CVE-2026-12817: Improper Validation of Integrity Check Value

In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned data. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 1.0.13 1.0.X series, 2.0.13 2.0.X series and 2.1.13 2.1.X series...

CVE-2026-18140

Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every generated struct deserializer, might allow remote unauthenticated users to cause a denial of service process abort via stack exhaustion via...

CVE-2026-18140

CVE-2026-18140 concerns the aws-smithy-json runtime before 0.62.7, where uncontrolled recursion in the unknown-key skip path is invoked by smithy-rs code generators from every generated struct deserializer. This may allow remote, unauthenticated actors to trigger a denial-of-service (process abor...