5126 matches found
CVE-2026-34786 vulnerabilities
Vulnerabilities for packages: pact-broker-docker-fips, ruby3.2-rails, gitlab-rails-ce, ruby3.3-rack, pact-broker-docker, ruby4.0-rack, ruby3.4-rack, gitlab-cng, ruby3.2-rack, kube-fluentd-operator, logstash, ruby3.4-rails, gitlab-rails-ce-fips...
CVE-2019-25656
R i386 3.5.0 contains a local buffer overflow vulnerability in the GUI Preferences dialog that allows local attackers to trigger a structured exception handler SEH overwrite by supplying malicious input. Attackers can craft a payload string in the 'Language for menus and messages' field to...
GHSA-XPG8-3HHP-P7W8 vulnerabilities
Vulnerabilities for packages: temporal, temporal-fips...
GHSA-F2HX-5FX3-HMCV vulnerabilities
Vulnerabilities for packages: keycloak, keycloak-fips...
GHSA-P5RH-VMHP-GVCW vulnerabilities
Vulnerabilities for packages: dgraph...
CVE-2026-35542
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via a crafted background attribute of a BODY element in an e-mail message. This may lead to information disclosure or access-control bypass...
ROS-20260403-73-0038
A vulnerability in the sound/soc/soc-core.c component of the Linux kernel is related to pointer dereferencing errors. Exploitation of the vulnerability allows an attacker to gain access to confidential data, compromise its integrity, and cause a denial-of-service condition...
SUSE CVE-2026-34525
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, multiple Host headers were allowed in aiohttp. This issue has been patched in version 3.13.4...
CVE-2026-34518 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines-visualization-server, py3.13-scanner-test-libraries-aiohttp, litellm, tritonserver-backend-vllm-cuda-12.9, airflow, awx, authentik, keep-fips, airflow-core, dask-kubernetes, datahub-ingestion-fips, metaflow-service, open-webui, request-1276,...
CVE-2026-34519 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines-visualization-server, py3.13-scanner-test-libraries-aiohttp, litellm, tritonserver-backend-vllm-cuda-12.9, airflow, awx, authentik, keep-fips, airflow-core, dask-kubernetes, datahub-ingestion-fips, metaflow-service, open-webui, request-1276,...
CVE-2025-58136
A bug in POST request handling causes a crash under a certain condition. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.1, from 9.0.0 through 9.2.12. Users are recommended to upgrade to version 10.1.2 or 9.2.13, which fix the issue. A workaround for older versions is to...
CVE-2026-34785
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static determines whether a request should be served as a static file using a simple string prefix check. When configured with URL prefixes such as "/css", it matches any request path that begins with...
vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin
A flaw was found in Vim, an open-source command-line text editor. Specifically, an operating system OS command injection vulnerability exists in the netrw standard plugin. A remote attacker could exploit this by tricking a user into opening a specially crafted URL, such as one using the scp://...
CVE-2026-34830
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Sendfilemapaccelpath interpolates the value of the X-Accel-Mapping request header directly into a regular expression when rewriting file paths for X-Accel-Redirect. Because the header value is not...
CVE-2026-34831
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Filesfail sets the Content-Length response header using Stringsize instead of Stringbytesize. When the response body contains multibyte UTF-8 characters, the declared Content-Length is smaller than the...
CVE-2026-5316
A vulnerability was identified in Nothings stb up to 1.22. The impacted element is the function setupfree of the file stbvorbis.c. The manipulation leads to allocation of resources. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor...
CVE-2026-5315
A vulnerability was determined in Nothings stb up to 1.26. The affected element is the function stbttbufget8 in the library stbtruetype.h of the component TTF File Handler. Executing a manipulation can lead to out-of-bounds read. The attack can be executed remotely. The exploit has been publicly...
CVE-2026-5313
A vulnerability has been found in Nothings stb up to 2.30. This issue affects the function stbigifloadnext in the library stbimage.h of the component GIF Decoder. Such manipulation leads to denial of service. The attack may be launched remotely. The exploit has been disclosed to the public and ma...
CVE-2026-34513
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an unbounded DNS cache could result in excessive memory usage possibly resulting in a DoS situation. This issue has been patched in version 3.13.4...