GHSA-V9PM-V9P5-H96X vulnerabilities

Vulnerabilities for packages: qemu...

GHSA-93QH-VWRM-C5PW vulnerabilities

Vulnerabilities for packages: jenkins...

CVE-2026-56408 vulnerabilities

Vulnerabilities for packages: expat...

GHSA-68VW-XV3C-52VP vulnerabilities

Vulnerabilities for packages: expat...

GHSA-JHV6-83WH-9VJ5 vulnerabilities

Vulnerabilities for packages: expat...

GHSA-R8QX-5VFX-8W6R vulnerabilities

Vulnerabilities for packages: expat...

GHSA-XQW9-F65G-5QXW vulnerabilities

Vulnerabilities for packages: expat...

CVE-2026-56409 vulnerabilities

Vulnerabilities for packages: expat...

GHSA-V2J6-3Q6Q-GM3G vulnerabilities

Vulnerabilities for packages: expat...

CVE-2026-56131 vulnerabilities

Vulnerabilities for packages: expat...

CVE-2026-56404 vulnerabilities

Vulnerabilities for packages: expat...

CVE-2026-54679

jq is a command-line JSON processor. Prior to 1.8.2, on 32bit system, jvpstringappend has a chance of integer/multiple overflowing and then causing a massive buffer overrun. This vulnerability is fixed in 1.8.2...

CVE-2026-6291

Bleichenbacher padding oracle in PKCS7 KTRI decryption. When decrypting PKCS7 EnvelopedData using RSA PKCS1 v1.5 key transport, wolfSSL returned distinguishable error codes depending on whether RSA padding validation failed versus whether the decrypted content was malformed. An attacker able to...

CVE-2026-57455

Vim is an open source, command line text editor. Prior to 9.2.0698, the single-byte branch of spellsoundfoldsofo in src/spell.c translates a word through a spell file's SOFO sound-folding byte map into a caller-owned result buffer. Its copy loop advances the output index ri with no upper bound an...

CVE-2026-53262

In the Linux kernel, the following vulnerability has been resolved: l2tp: pppol2tp: hold reference to session in pppol2tpioctl pppol2tpioctl read sock-sk-skuserdata directly without any locks or reference counting. If a controllable sleep was induced during copyfromuser e.g. via a userfaultfd pag...

CVE-2026-53236

In the Linux kernel, the following vulnerability has been resolved: tcp: restrict SOATTACHFILTER to priv users This patch restricts the use of SOATTACHFILTER cBPF on TCP sockets to users with CAPNETADMIN capability. This blocks potential side-channel attack where an unprivileged application...

CVE-2026-9595 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, gitlab-rails-ce-fips, kubeflow-katib, argo-workflows, arangodb...

CVE-2026-40079

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Command Injection due to lack of sanitization in the escapecommand function. The escapecommand function at lib/rrd.php is a no-op: it returns $command unchanged. The command line built ...

CVE-2026-39948

Cacti is an open source performance and fault management framework. In versions 1.2.30 and prior, the rfilter request parameter is retrieved via the raw accessor grv rather than gfrv with FILTERVALIDATEISREGEX validation and concatenated directly into RLIKE SQL clauses in lib/htmlgraph.php and...

CVE-2026-39938

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have unauthenticated LFI through graphtheme and rrdtool IPC serialization hardening. This issue has been resolved in version 1.2.31...