CVE-2026-58063 vulnerabilities

Vulnerabilities for packages: bouncycastle-fips...

Astra Linux – Vulnerability in Firefox

Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 150 and Thunderbird 150...

CVE-2026-55737 affecting package erlang for versions less than 26.2.5.21-3

CVE-2026-55737 affecting package erlang for versions less than 26.2.5.21-3. A patched version of the package is available...

SUSE CVE-2026-54787

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired...

CVE-2026-67857

open62541 1.5.5 contains an out-of-bounds read in the client-side function responseReadNamespacesArray in src/client/uaclientconnect.c...

GHSA-MQ44-7P77-Q5H7 vulnerabilities

Vulnerabilities for packages: py3-vllm-cuda-12.4, puppygraph-python, airflow-core, open-webui, airflow, kserve-models-web-app, awx, apache-beam-python-3.11-sdk, text-generation-inference, dask-kubernetes, apache-beam-python-3.12-sdk, kserve, lmcache-cuda-12.8, py3-cassandra-medusa,...

CVE-2026-69152 vulnerabilities

Vulnerabilities for packages: prism, nextcloud-server, npm, rancher-api-ui, sqlpad, jupyter-base-notebook, langfuse, kubeflow-katib, serve, renovate, opensearch-dashboards, argo-workflows, ts-patch, pulumi, saf...

GHSA-G6CJ-PR64-35W5 vulnerabilities

Vulnerabilities for packages: mycli, open-webui, mitmproxy, airflow, k8s-sidecar, kserve, datadog-agent, ggshield, mlflow, py3-cassandra-medusa, kubeflow-volumes-web-app, dask-kubernetes, semgrep, superset, az, kubeflow, in-toto...

GHSA-JR45-8VMC-QM54 vulnerabilities

Vulnerabilities for packages: vitess, renovate, langfuse, code-server...

GHSA-V3R7-H72X-CJCM vulnerabilities

Vulnerabilities for packages: prism, npm, vitess, langfuse, code-server, renovate, pulumi, saf...

CVE-2026-15337

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.utils.translation.checkforlanguage is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory...

CVE-2026-70368

A stack-based out-of-bounds read vulnerability exists in the "svlog" function of stunnel, when handling oversized log messages via "vsnprintf". A remote attacker with network access to a stunnel service can send protocol inputs that trigger a log message longer than 1024 bytes, leading to an...

golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey

A flaw was found in golang.org/x/crypto/ssh/knownhosts. This vulnerability occurs because the system did not correctly check for the revocation status of a SignatureKey belonging to a Certificate Authority CA. A remote attacker could potentially exploit this by presenting a revoked key, leading t...

CVE-2026-18772

Improperly controlled sequential memory allocation vulnerability in Samsung Open Source rlottie allows Exponential Data Expansion...

CVE-2026-14351 vulnerabilities

Vulnerabilities for packages: gitlab-cng, gitlab-runner-fips, gitlab-workhorse-ce, gitlab-rails-ce-fips, gitlab-runner, gitlab-rails-ce, gitlab-workhorse-ce-fips, gitlab-cng-fips...

GHSA-35PC-QWV6-4858 vulnerabilities

Vulnerabilities for packages: gitlab-cng, gitlab-runner-fips, gitlab-workhorse-ce, gitlab-rails-ce-fips, gitlab-runner, gitlab-rails-ce, gitlab-workhorse-ce-fips, gitlab-cng-fips...

[SECURITY] Fedora 44 Update: python-nh3-0.3.6-4.fc44

Python binding to Ammonia HTML sanitizer Rust crate...

GHSA-HHF8-3X8G-6PFF vulnerabilities

Vulnerabilities for packages: openjdk...

gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb

A heap buffer overflow vulnerability was found in GStreamer's librfb RFB/VNC client. The rectangle bounds check incorrectly validates area rather than individual dimensions, allowing a malicious VNC server to send a rectangle that extends beyond the framebuffer. A remote attacker could set up a...

mariadb: Arbitrary Code Execution via improper parameter validation during State Snapshot Transfer

A flaw was found in MariaDB. During a State Snapshot Transfer SST, the donor node improperly validates parameters sent by a joiner node. This vulnerability allows a malicious joiner to execute arbitrary shell commands on the donor server through the mariabackup SST method. This could lead to a...