CVE-2026-63073 Untrusted Sender DN Used as Format String in CMP Response Validation

Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to ERRraisedata. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate...

CVE-2026-63073

OpenSSL CMP protocol validation contains a format string injection (CWE-134): ossl_cmp_msg_check_update() passes a peer-supplied sender distinguished name—after X509_NAME_oneline() conversion—directly as the format argument to ERR_raise_data(). A malicious or intercepted CMP endpoint can send a D...

CVE-2026-63073

Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to ERRraisedata. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate...

CVE-2026-63073

Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to ERRraisedata. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate...

EUVD-2026-65483

Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to ERRraisedata. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate...

CVE-2026-63073 Untrusted Sender DN Used as Format String in CMP Response Validation

Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to ERRraisedata. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate...

CVE-2026-63073 Untrusted Sender DN Used as Format String in CMP Response Validation

Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to ERRraisedata. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate...

EUVD-2026-65396

SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to Hive Metastore APIs to read, modify, or affect unintended partition metadata including statistics updates, truncation targets, and...

CVE-2026-49845 Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL paths

SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to Hive Metastore APIs to read, modify, or affect unintended partition metadata including statistics updates, truncation targets, and...

CVE-2026-49845 Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL paths

SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to Hive Metastore APIs to read, modify, or affect unintended partition metadata including statistics updates, truncation targets, and...

libgit2: libgit2: Denial of Service due to heap out-of-bounds read from malicious Git server

A flaw was found in libgit2. A fixed-size string comparison in the setdata function within transports/smartpkt.c does not adequately verify the size of a network packet buffer. A remote attacker, operating a malicious Git server, can send a specially crafted packet-line capability buffer. This ca...

CVE-2026-78322

A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive containing a file entry with an excessively long path, file-roller's progress-line parsing copies the path into a fixed-size stack buffer using an unbounded string copy. This can trigger a stack buffer...

CVE-2026-78322

file-roller (GNOME archive manager) is affected by a stack buffer overflow in the parse_progress_line function used by its 7z and RAR handlers . When a victim opens or extracts a crafted archive containing a file entry with an excessively long path, the path is copied into a fixed-size stack buff...

CVE-2026-78322

A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive containing a file entry with an excessively long path, file-roller's progress-line parsing copies the path into a fixed-size stack buffer using an unbounded string copy. This can trigger a stack buffer...

CVE-2026-78322 File-roller: file-roller: stack buffer overflow in parse_progress_line for 7z and rar handlers

A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive containing a file entry with an excessively long path, file-roller's progress-line parsing copies the path into a fixed-size stack buffer using an unbounded string copy. This can trigger a stack buffer...

CVE-2026-78322 File-roller: file-roller: stack buffer overflow in parse_progress_line for 7z and rar handlers

A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive containing a file entry with an excessively long path, file-roller's progress-line parsing copies the path into a fixed-size stack buffer using an unbounded string copy. This can trigger a stack buffer...

EUVD-2026-65311

A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive containing a file entry with an excessively long path, file-roller's progress-line parsing copies the path into a fixed-size stack buffer using an unbounded string copy. This can trigger a stack buffer...

CVE-2026-78322

A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive containing a file entry with an excessively long path, file-roller's progress-line parsing copies the path into a fixed-size stack buffer using an unbounded string copy. This can trigger a stack buffer...

CVE-2026-72701

Grav CMS before 2.0.16 contains a timing vulnerability in Utils::verifyNonce that uses non-constant-time string comparison with the === operator instead of hashequals for CSRF nonce validation. Attackers can measure response timing differences to recover valid nonce values byte-by-byte through...

DEBIAN-CVE-2026-56704

Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing...