CVE-2026-27585

A flaw was found in Caddy, an extensible server platform. The path sanitization routine in the file matcher component does not properly sanitize backslashes. This vulnerability can be exploited by users with specific Caddy and environment configurations, potentially leading to the bypass of...

CVE-2026-27588

A flaw was found in Caddy's HTTP host request matcher. When Caddy is configured with a large list of host entries, its host matching becomes unexpectedly case-sensitive instead of case-insensitive as documented. A remote attacker can exploit this by altering the casing of the Host header in HTTP...

CVE-2026-27571

A flaw was found in nats-server. The WebSockets implementation fails to enforce a memory allocation limit during the decompression of WebSocket messages. A malicious compressed payload allows an attacker to cause an excessive memory consumption, eventually resulting in a server crash and a comple...

CVE-2026-27589

A flaw was found in Caddy. The local administration API, when origin enforcement is not enabled, accepts cross-origin requests to its configuration loading endpoint. A remote attacker can exploit this by tricking a victim's browser into sending a malicious JSON configuration. This allows for...

CVE-2026-27587

A flaw was found in Caddy, an extensible server platform. The HTTP path request matcher, intended to be case-insensitive, incorrectly processes percent-escape sequences. This vulnerability allows a remote attacker to bypass path-based routing and associated access controls by manipulating the...

CVE-2026-27590

A flaw was found in Caddy's FastCGI path splitting logic. This vulnerability arises because the system computes the split index on a lowercased copy of the request path, which can be unsafe for Unicode characters. A remote attacker could exploit this by sending a specially crafted request, leadin...

CVE-2026-27586

A flaw was found in Caddy, an extensible server platform. Two errors in the ClientAuthentication.provision function can cause mutual Transport Layer Security mTLS client certificate authentication to silently fail open. This occurs when a Certificate Authority CA certificate file is missing,...

CVE-2026-2781

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Integer overflow in the Libraries component in NSS...

CVE-2026-2769

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Storage: IndexedDB component...

CVE-2026-2763

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript Engine component...

CVE-2026-2760

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component...

CVE-2026-1229

A flaw was found in the github.com/cloudflare/circl/ecc/p384 package. The CombinedMult function, which is part of the elliptic curve cryptography ECC implementation for the secp384r1 curve, generates an incorrect value when provided with specific inputs. This can lead to incorrect cryptographic...

CVE-2026-3121

A flaw was found in Keycloak. An administrator with manage-clients permission can exploit a misconfiguration where this permission is equivalent to manage-permissions. This allows the administrator to escalate privileges and gain control over roles, users, or other administrative functions within...

CVE-2026-3099

A flaw was found in Libsoup. The server-side digest authentication implementation in the SoupAuthDomainDigest class does not properly track issued nonces or enforce the required incrementing nonce-count nc attribute. This vulnerability allows a remote attacker to capture a single valid...

CVE-2026-25969

A flaw was found in ImageMagick, a software used for editing and manipulating digital images. This vulnerability, a memory leak, occurs when the software processes certain image files. Specifically, during image writing operations, if an error occurs, allocated memory is not properly released. A...

Linux Distros Unpatched Vulnerability : CVE-2026-2787

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the DOM: Window and Location component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, a...

Linux Distros Unpatched Vulnerability : CVE-2026-3062

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out of bounds read and write in Tint in Google Chrome on Mac prior to 145.0.7632.116 allowed a remote attacker to perform out of bounds memory access via a...

CVE-2025-61147

strukturag libde265 commit d9fea9d wa discovered to contain a segmentation fault via the component decodercontext::computeframedroptable. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ea...

CVE-2025-61144

A denial of service flaw has been found in libtiff. This stack-based buffer overflow occurs in tiffcrop part of libtiff within the function readSeparateStripsIntoBuffer. When processing a malformed TIFF directory e.g., improper tags/order, missing StripByteCounts, the function overflows a...

CVE-2025-61143

A flaw was found in libtiff. This vulnerability, a NULL pointer dereference, occurs in the tifopen.c component. An attacker could exploit this by providing specially crafted input, leading to a Denial of Service DoS due to an application crash. Mitigation Mitigation for this issue is either not...