CVE-2026-13601

A flaw was found in Yelp due to an overly permissive Content Security Policy CSP implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document,...

ROS-20260629-73-0002

The vulnerability in ImageMagick 7 is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260629-73-0030

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

GHSA-R2JR-M2RH-F5HG vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-54896 vulnerabilities

Vulnerabilities for packages: ruby4.0-fluentd-kubernetes-daemonset, ruby3.2-fluentd-kubernetes-daemonset, ruby3.3-fluentd-kubernetes-daemonset, ruby3.4-fluentd-kubernetes-daemonset, kube-logging-operator...

CVE-2026-30405 vulnerabilities

Vulnerabilities for packages: cilium-cli, kube-vip-fips, kube-vip...

CVE-2026-46604

The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset...

GHSA-52X6-GQ3R-VPF4 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-MPWR-8VM7-H73F vulnerabilities

Vulnerabilities for packages: grafana, crossplane-provider-azure-managedidentity, gobuster, cert-manager, nfpm, crossplane-provider-azure-storage, x509-certificate-exporter, telegraf, external-secrets-operator, crossplane-provider-azure-sql, nuclei, splunk-otel-collector, goreleaser,...

CVE-2026-46601 vulnerabilities

Vulnerabilities for packages: rclone, gitea, mailpit, mattermost, bento, ollama, kubescape, seaweedfs, pdfcpu...

CVE-2026-57918

libnfs through 6.0.2 before 935b8db has an xid integer underflow in READIOVEC in rpcreadfromsocket in lib/socket.c during a connection to a crafted NFS server, when the expected pdu size exceeds the absolute pdu size from the xid/record-marker...

SUSE CVE-2026-57434

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from Nokogiri::XML::Node. This caused a NULL pointer dereference that could...

CVE-2026-6331

HMAC zero-length tag forgery in EVPDigestVerifyFinal, where a zero-length tag could be accepted as valid during HMAC verification. In the OpenSSL-compatibility HMAC verify path the supplied signature length was only checked as not exceeding the MAC length, so a zero-length or otherwise truncated...

CVE-2026-22879

vtk vtk-dicom vtkDICOMItem::NewDataElement heap-based buffer overflow vulnerability...

perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob

A flaw was found in perl-IO-Compress, a component used for data compression and decompression. A remote attacker could exploit this vulnerability by crafting a malicious input, specifically an output glob, that bypasses the intended security measures. This could lead to the execution of...

GHSA-V6W7-GQ3G-FWVM vulnerabilities

Vulnerabilities for packages: qemu...

GHSA-XQW9-F65G-5QXW vulnerabilities

Vulnerabilities for packages: expat...

GHSA-M2MM-5W64-P8P7 vulnerabilities

Vulnerabilities for packages: expat...

GHSA-FCHF-WVCC-QF9G vulnerabilities

Vulnerabilities for packages: expat...

CVE-2026-6681

The PKCS7 decode path ignores the caller-supplied output buffer size outputSz, allowing decoded content to be written past the bounds of the provided buffer. This affects wolfSSL 5.9.0 and earlier and was fixed in the 5.9.1 release...