EUVD-2026-46180

Parse Server versions = 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled graphQLPublicIntrospection: false, the default, schema-derived 'Did you mean ...?' suggestions were still...

CVE-2026-64627

Parse Server versions 9.0.0–8.6.84/9.0.0–9.10.0-alpha.3 contain a schema disclosure vulnerability where, when GraphQL public introspection is disabled, error messages during variable coercion reveal hidden schema identifiers (e.g., Cloud Code function names, Parse class/field names) to an unauthe...

CVE-2026-59844

A flaw was found in libssh. A remote authenticated client can issue SSHFXPREAD requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests...

CVE-2026-59844

A flaw was found in libssh. A remote authenticated client can issue SSHFXPREAD requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests...

CVE-2026-59842

A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without proper length validation, leading to an out-of-bounds heap read. This could allow a remote unauthenticated attacker to disclose small...

CVE-2026-59842

A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without proper length validation, leading to an out-of-bounds heap read. This could allow a remote unauthenticated attacker to disclose small...

CVE-2026-59842

Affects: libssh. In server-side GSSAPI key exchange, a Curve25519 public key shorter than the expected length is copied without proper length validation, causing an out-of-bounds heap read. This could let a remote unauthenticated attacker disclose small amounts of server memory. Mitigation: vendo...

CVE-2026-59842 Libssh: libssh: information disclosure via short gssapi curve25519 public key

A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without proper length validation, leading to an out-of-bounds heap read. This could allow a remote unauthenticated attacker to disclose small...

CVE-2026-59842

A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without proper length validation, leading to an out-of-bounds heap read. This could allow a remote unauthenticated attacker to disclose small...

CLEANSTART-2026-NW12954 Security fixes for CVE-2020-8908, CVE-2023-2976, CVE-2025-67735, CVE-2026-0636, CVE-2026-1225, CVE-2026-22741, CVE-2026-22745, CVE-2026-22746, CVE-2026-22751, CVE-2026-33870, CVE-2026-33871, CVE-2026-40973, CVE-2026-41284, CVE-2026-41293, CVE-2026-41417, CVE-2026-42498, CVE-2026-42580, CVE-2026-42581, CVE-2026-42583, CVE-2026-42584, CVE-2026-42585, CVE-2026-42587, CVE-2026-43512, CVE-2026-43513, CVE-2026-43514, CVE-2026-43515, CVE-2026-44249, CVE-2026-45416, CVE-2026-50010, CVE-2026-50020, CVE-2026-5598, ghsa-38f8-5428-x5cv, ghsa-3qp7-7mw8-wx86, ghsa-563q-j3cm-6jxm, ghsa-57rv-r2g8-2cj3, ghsa-5mg8-w23w-74h3, ghsa-5x3r-wrvg-rp6q, ghsa-72hv-8253-57qq, ghsa-7g45-4rm6-3mm3, ghsa-84h7-rjj3-6jx4, ghsa-c2gf-v879-257j, ghsa-c653-97m9-rcg9, ghsa-f6hv-jmp6-3vwv, ghsa-hvcg-qmg6-jm4c, ghsa-m4cv-j2px-7723, ghsa-mj4r-2hfc-f8p6, ghsa-pwqr-wmgm-9rr8, ghsa-qqpg-mvqg-649v, ghsa-v8h7-rr48-vmmv, ghsa-w9fj-cfpg-grvv, ghsa-wwpq-f5c3-7hvx, ghsa-x4gw-5cx5-pgmh, ghsa-xxqh-mfjm-7mv9 applied in versions: 4.3.2-r2, 4.3.2-r3

Multiple security vulnerabilities affect the cloud-config-server package. These issues are resolved in later releases. See references for individual vulnerability details...

Vulnerabilities handled in IBM Langflow OSS

IBM has addressed several vulnerabilities in the IBM Langflow OSS versions from 1.0.0 to 1.10.0. The vulnerabilities in IBM Langflow OSS include: - Execution of arbitrary file modifications by authorized users through specially crafted Content-Disposition headers. - Server-side request forgery SS...

CVE-2026-15370

A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buffer and may lead ...

CVE-2026-15370

A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buffer and may lead ...

CVE-2026-15370

A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buffer and may lead ...

CVE-2026-15370

A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buffer and may lead ...

CVE-2026-15370 Libssh: libssh: stack buffer overflow in sftp server longname construction

A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buffer and may lead ...

CVE-2026-15370 Libssh: libssh: stack buffer overflow in sftp server longname construction

A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buffer and may lead ...

EUVD-2026-46169

A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buffer and may lead ...

CVE-2026-15370

CVE-2026-15370 is a vulnerability in libssh where, during SFTP server directory listing, the longname field is built by unsafe string concatenation into a fixed-size stack buffer. This can allow sufficiently long attacker-controlled filenames to overflow the stack, potentially crashing the server...

Stack-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Stack-based Buffer Overflow in the construction of the longname field during SFTP server directory listing. An attacker can cause a crash or execute arbitrary code on the server by supplying specially crafted, excessively long filenames...