CVE-2026-5500

wolfSSL's wcPKCS7DecodeAuthEnvelopedData does not properly sanitize the AES-GCM authentication tag length received and has no lower bounds check. A man-in-the-middle can therefore truncate the mac field from 16 bytes to 1 byte, reducing the tag check from 2⁻¹²⁸ to 2⁻⁸...

GHSA-3MWP-WVH9-7528 vulnerabilities

Vulnerabilities for packages: py3-vllm-cuda-12.4, tritonserver-backend-vllm-cuda-13.0, vllm-openai-cuda-12.9...

GHSA-43RW-359F-4H89 vulnerabilities

Vulnerabilities for packages: python...

CVE-2026-39859 vulnerabilities

Vulnerabilities for packages: kibana...

GHSA-MJMQ-GWGM-5QHM vulnerabilities

Vulnerabilities for packages: hadoop-fips...

GHSA-JR6H-R7VG-F9MC vulnerabilities

Vulnerabilities for packages: druid...

CVE-2026-33034 vulnerabilities

Vulnerabilities for packages: authentik-fips, label-studio, authentik, awx...

GHSA-5MF9-H53Q-7MHQ vulnerabilities

Vulnerabilities for packages: authentik-fips, label-studio, authentik, awx...

ROS-20260410-73-0004

A vulnerability in the Node.js software platform involves an incorrect restriction of the path name of a restricted directory. Exploitation of the vulnerability could allow an attacker to compromise the system...

ROS-20260410-73-0017

Vulnerability in expat related to null pointer dereferencing. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

ROS-20260410-73-0009

Vulnerability in libssh related to incorrect external control of file name or path. Exploitation of the vulnerability could allow an attacker to escalate privileges...

ROS-20260410-73-0016

Vulnerability in curl related to authentication bypass due to an initial bug. Exploitation of the vulnerability could allow an attacker acting remotely to escalate their privileges...

SUSE CVE-2026-5918

Inappropriate implementation in Navigation in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

CVE-2026-21713 affecting package nodejs for versions less than 20.14.0-15

CVE-2026-21713 affecting package nodejs for versions less than 20.14.0-15. A patched version of the package is available...

CVE-2026-5264

Heap buffer overflow in DTLS 1.3 ACK message processing. A remote attacker can send a crafted DTLS 1.3 ACK message that triggers a heap buffer overflow...

GHSA-W8RR-5GCM-PP58 vulnerabilities

Vulnerabilities for packages: spicedb, hydra, k6, headlamp, knative-serving, jaeger, tekton-pipelines, traefik, envoy-gateway, caddy, opa, prometheus-alertmanager, thanos, external-dns, fluent-bit-plugin-loki, buildkitd, docker-cli-buildx, tempo, gitaly, teleport, amazon-cloudwatch-agent,...

CVE-2026-5439

A memory exhaustion vulnerability exists in ZIP archive processing. Orthanc automatically extracts ZIP archives uploaded to certain endpoints and trusts metadata fields describing the uncompressed size of archived files. An attacker can craft a small ZIP archive containing a forged size value,...

CVE-2026-34757

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG Portable Network Graphics raster image files. From 1.0.9 to before 1.6.57, passing a pointer obtained from pnggetPLTE, pnggettRNS, or pnggethIST back into the corresponding setter on the same...

minimatch: minimatch: Denial of Service via specially crafted glob patterns

A flaw was found in minimatch. A remote attacker could exploit this Regular Expression Denial of Service ReDoS vulnerability by providing a specially crafted glob pattern. This pattern, containing numerous consecutive wildcard characters, causes excessive processing and exponential backtracking i...

ruby: missing "taintness" checks in dl module

The dl module in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not check "taintness" of inputs, which allows context-dependent attackers to bypass safe levels and execute dangerous functions by accessing a library using DL.dlopen...