567 matches found
GHSA-88FW-V6X4-3F58 vulnerabilities
Vulnerabilities for packages: apache-nifi-registry...
CVE-2026-67289
FreeRDP before 3.29.0 affected versions = 3.28.0 does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written directly into the...
GHSA-3CHG-M5W7-QFV5 vulnerabilities
Vulnerabilities for packages: apache-nifi-registry...
SUSE CVE-2026-18001
Inappropriate implementation in WebGL in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Low...
GHSA-3FXJ-6JH8-HVHX vulnerabilities
Vulnerabilities for packages: zitadel, cosmo-router-fips, telegraf, cosmo-router, karma-fips...
CVE-2026-64308
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctlSNPVLEKLOAD Sashiko notes: if SEV initialization fails and KVM is actively running normal VMs, could a userspace process trigger this code path via /dev/sev ioctls e.g., SEVPDHGEN and...
GHSA-2X63-GW47-W4MM vulnerabilities
Vulnerabilities for packages: pghero-fips, pghero, ruby4.0-rails...
ROS-20260724-73-0039
The vulnerability in ImageMagick is related to the lack of memory release after the effective lifespan of the component. Exploiting this vulnerability can allow an attacker to cause a service failure...
ROS-20260724-73-0017
The vulnerability of the Oracle MySQL Server component of the database management system’s optimizer is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service interruptions...
CVE-2026-65901
DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in INPLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements,...
bind: bind9: Unnecessary validation of DNSSEC signed records
The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not strictly needed. A query to an authoritative server/zone which returns many valid but superfluous RRSIG records causes the validator to...
dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM
.NET Denial of Service Vulnerability - HTTP/2 SETTINGS/PING ACK flood causing OOM...
dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation
A flaw was found in .NET Framework. An unauthorized attacker can exploit this vulnerability remotely by causing the system to allocate resources without proper limits or throttling. This uncontrolled resource allocation can lead to a Denial of Service DoS, making the affected system unresponsive ...
CVE-2026-26081
HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEWTOKEN format. HAProxy Enterprise and ALOHA are also affected...
GHSA-5CVC-PM9V-PW7P vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-72XF-G2V4-QVF3 vulnerabilities
Vulnerabilities for packages: kubeflow-katib...
GHSA-FQPX-62JV-7R6R vulnerabilities
Vulnerabilities for packages: kubeflow-katib...
GHSA-Q856-GH5W-3VWG vulnerabilities
Vulnerabilities for packages: kubeflow-katib...