CVE-2026-3644 vulnerabilities

Vulnerabilities for packages: python...

GHSA-VF33-88PF-HWP3 vulnerabilities

Vulnerabilities for packages: python...

CVE-2026-2625

A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a specially crafted Red Hat Package Manager RPM file. During the RPM signature verification process, this crafted file can trigger an error in the OpenPGP signature parsing code, leading to an...

CVE-2026-23444

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: always free skb on ieee80211txprepareskb failure ieee80211txprepareskb has three error paths, but only two of them free the skb. The first error path ieee80211txprepare returning TXDROP does not free it, while...

CVE-2026-2950 vulnerabilities

Vulnerabilities for packages: kubeflow-centraldashboard, foxx-cli, prism, py3-captum, langfuse-fips, gitlab-rails-ce, jitsucom-jitsu, sqlpad, pelias-api, code-server, drupal, opensearch-dashboards, renovate, gitlab-rails-ce-fips, tensorflow-cpu-jupyter, kubeflow-katib, redisinsight, ts-patch,...

GHSA-M5WQ-R4R4-4QRH vulnerabilities

Vulnerabilities for packages: glibc...

CVE-2026-2950 vulnerabilities

Vulnerabilities for packages: vitess, code-server, sqlpad, json-server, ts-patch, jitsucom-jitsu, prism, py3-jupyterlab, opensearch-dashboards, kubeflow-katib, argo-workflows, saf, renovate, langfuse, kubeflow-pipelines, kubeflow-centraldashboard, npm...

GHSA-M5WQ-R4R4-4QRH vulnerabilities

Vulnerabilities for packages: glibc...

CVE-2026-34835

Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack::Request parses the Host header using an AUTHORITY regular expression that accepts characters not permitted in RFC-compliant hostnames, including /, ?, , and @. Because req.hos...

CVE-2026-34763

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Directory interpolates the configured root path directly into a regular expression when deriving the displayed directory path. If root contains regex metacharacters such as +, , or ., the prefix...

CVE-2026-34831

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Filesfail sets the Content-Length response header using Stringsize instead of Stringbytesize. When the response body contains multibyte UTF-8 characters, the declared Content-Length is smaller than the...

GHSA-RM92-FJ5Q-MPJ5 vulnerabilities

Vulnerabilities for packages: python...

SUSE CVE-2026-34743

XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzmaindexdecoder was used to decode an Index that contained no Records, the resulting lzmaindex was left in a state where where a subsequent lzmaindexappend would allocate too little...

GHSA-WMRF-HV6W-MR66 vulnerabilities

Vulnerabilities for packages: langfuse, langfuse-fips...

CVE-2026-22731 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, camunda-zeebe, camunda...

CVE-2026-34871

An issue was discovered in Mbed TLS before 3.6.6 and 4.x before 4.1.0 and TF-PSA-Crypto before 1.1.0. There is a Predictable Seed in a Pseudo-Random Number Generator PRNG...

CVE-2026-27489

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. Prior to version 1.21.0, a path traversal vulnerability via symlink allows to read arbitrary files outside model or user-provided directory. This issue has been patched in version 1.21.0...

CVE-2026-34159

llama.cpp is an inference of several LLM models in C/C++. Prior to version b8492, the RPC backend's deserializetensor skips all bounds validation when a tensor's buffer field is 0. An unauthenticated attacker can read and write arbitrary process memory via crafted GRAPHCOMPUTE messages. Combined...

CVE-2026-33990

Docker Model Runner DMR is software used to manage, run, and deploy AI models using Docker. Prior to version 1.1.25, Docker Model Runner contains an SSRF vulnerability in its OCI registry token exchange flow. When pulling a model, Model Runner follows the realm URL from the registry's...

CVE-2026-35091

A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Corosync membership commit token sanity check by sending a specially crafted User Datagram Protocol UDP packet. This can lead to an out-of-bounds read, causing a denial of service...