CVE-2026-42038

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, he fix for noproxy hostname normalization bypass is incomplete. When noproxy=localhost is set, requests to 127.0.0.1 and ::1 still route through the proxy instead of bypassing it. The shouldBypassProxy...

CVE-2026-42035

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter lib/adapters/http.js that allows an attacker to inject arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type...

CVE-2026-31625

In the Linux kernel, the following vulnerability has been resolved: HID: alps: fix NULL pointer dereference in alpsrawevent Commit ecfa6f34492c "HID: Add HIDCLAIMEDINPUT guards in rawevent callbacks missing them" attempted to fix up the HID drivers that had missed the previous fix that was done i...

CVE-2026-41139 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards...

GHSA-F9G8-6PPC-PQQ4 vulnerabilities

Vulnerabilities for packages: kyverno-fips, kyverno-notation-aws, kyverno-notation-aws-fips, kyverno...

CVE-2026-31471

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: only publish modedata after clone setup iptfsclonestate stores x-modedata before allocating the reorder window. If that allocation fails, the code frees the cloned state and returns -ENOMEM, leaving x-modedata pointi...

CVE-2026-31472

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: validate inner IPv4 header length in IPTFS payload Add validation of the inner IPv4 packet totlen and ihl fields parsed from decrypted IPTFS payloads in inputprocesspayload. A crafted ESP packet containing an inner...

CVE-2026-6842

A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions 0777 instead of 0700 for the /.local directory. This allows the attacker to inject a malicious .desktop launcher, which could lead to unintended actions or...

firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions, integer overflow in the Graphics: Text component...

CVE-2026-6779

Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150 and Thunderbird 150...

GHSA-FJRM-76X2-C4Q4 vulnerabilities

Vulnerabilities for packages: py3-jwcrypto...

CVE-2026-33375 vulnerabilities

Vulnerabilities for packages: grafana-fips...

GHSA-VV23-JMR5-38V3 vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-5879 vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-3M3G-56CX-59Q7 vulnerabilities

Vulnerabilities for packages: chromium...

[SECURITY] Fedora 44 Update: plasma-integration-6.6.4-1.fc44

Qt Platform Theme integration plugin for Plasma...

CVE-2026-40293 vulnerabilities

Vulnerabilities for packages: grafana, openfga...

GHSA-24J9-X2WG-9QV6 vulnerabilities

Vulnerabilities for packages: ontop-fips, kayenta, camunda-zeebe, ontop, kayenta-fips, nacos-docker, nacos, camunda, thingsboard...

CVE-2026-34829 vulnerabilities

Vulnerabilities for packages: ruby4.0-rack, ruby3.3-rack, kube-fluentd-operator, logstash, ruby3.4-rack, ruby3.2-rack...

CVE-2026-5194

Missing hash/digest size and OID checks allow digests smaller than allowed when verifying ECDSA certificates, or smaller than is appropriate for the relevant key type, to be accepted by signature verification functions. This could lead to reduced security of ECDSA certificate-based authentication...