CVE-2025-67125

A signed integer overflow in docopt.cpp v0.6.2 LeafPattern::match in docoptprivate.h when merging occurrence counters e.g., default LONGMAX + first user "-v/--verbose" can cause counter wrap negative/unbounded semantics and lead to logic/policy bypass in applications that rely on occurrence-based...

GHSA-R2MR-X4H2-9CHR vulnerabilities

Vulnerabilities for packages: openjdk...

ROS-20260122-73-0031

Vulnerability in ImageMagick related to reading outside buffer boundaries in memory. Exploitation of the vulnerability may allow an attacker to cause a denial of service...

GHSA-C336-7962-WFJ2 vulnerabilities

Vulnerabilities for packages: dask-kubernetes, dask-gateway...

GHSA-XP56-6525-9CHF vulnerabilities

Vulnerabilities for packages: glibc...

firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component...

firefox: thunderbird: Use-after-free in the IPC component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the IPC component...

CVE-2024-31884

Incorrect usage of certificate checking via Pybind...

CVE-2025-12748 affecting package libvirt for versions less than 10.0.0-7

CVE-2025-12748 affecting package libvirt for versions less than 10.0.0-7. A patched version of the package is available...

CVE-2026-21441 affecting package tensorflow for versions less than 2.16.1-10

CVE-2026-21441 affecting package tensorflow for versions less than 2.16.1-10. A patched version of the package is available...

CVE-2025-59465

A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node.js to crash by triggering an unhandled TLSSocket error ECONNRESET. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not...

CVE-2026-21637

A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when pskCallback or ALPNCallback are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths tlsClientError and error, causing either immediate...

CVE-2025-59466

We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when asynchooks.createHook is enabled. Instead of reaching process.on'uncaughtException', the process terminates, making the crash unrecoverable. Applications that rely on...

CVE-2026-21226 vulnerabilities

Vulnerabilities for packages: kserve, airflow, duplicity, pgadmin4, open-webui, py3-cassandra-medusa, request-1276, awx, datadog-agent-fips, az, barman, authentik-fips, authentik, datadog-agent...

CVE-2025-36115 Multiple vulnerabilities were addressed in IBM Sterling Connect:Express for UNIX.

IBM Sterling Connect:Express Adapter for Sterling B2B Integrator 5.2.0.00 through 5.2.0.12 does not disallow the session id after use which could allow an authenticated user to impersonate another user on the system...

CVE-2025-36113 Multiple vulnerabilities were addressed in IBM Sterling Connect:Express for UNIX.

IBM Sterling Connect:Express Adapter for Sterling B2B Integrator 5.2.0 5.2.0.00 through 5.2.0.12 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...

net-snmp: buffer overflow via a specially crafted packet can cause a crash in snmptrapd

A flaw was found in net-snmp. A remote attacker can trigger a buffer overflow in the snmptrapd daemon by sending a specially crafted SNMP packet, causing the daemon to crash and resulting in a denial of service...

CVE-2026-23745 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, pnpm-stage0, renovate, kubeflow-pipelines, lerna, kubeflow-centraldashboard, node-gyp, vitess, prism, py3-jupyterlab, saf, sqlpad, npm, pulumi, kubeflow-katib, code-server, tileserver-gl...

ROS-20260120-7319

Vulnerability in kernel-lt related to incorrect resource locking. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

PT-2026-3581

IBM Sterling Connect:Direct for UNIX Container 6.3.0.0 through 6.3.0.6 Interim Fix 016, and 6.4.0.0 through 6.4.0.3 Interim Fix 019 IBM® Sterling Connect:Direct for UNIX contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication,...