GHSA-RM92-FJ5Q-MPJ5 vulnerabilities

Vulnerabilities for packages: python...

SUSE CVE-2026-34743

XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzmaindexdecoder was used to decode an Index that contained no Records, the resulting lzmaindex was left in a state where where a subsequent lzmaindexappend would allocate too little...

GHSA-WMRF-HV6W-MR66 vulnerabilities

Vulnerabilities for packages: langfuse-fips, langfuse...

CVE-2026-22731 vulnerabilities

Vulnerabilities for packages: camunda-zeebe, apache-nifi-registry, camunda...

CVE-2026-34871

An issue was discovered in Mbed TLS before 3.6.6 and 4.x before 4.1.0 and TF-PSA-Crypto before 1.1.0. There is a Predictable Seed in a Pseudo-Random Number Generator PRNG...

CVE-2026-27489

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. Prior to version 1.21.0, a path traversal vulnerability via symlink allows to read arbitrary files outside model or user-provided directory. This issue has been patched in version 1.21.0...

CVE-2026-34159

llama.cpp is an inference of several LLM models in C/C++. Prior to version b8492, the RPC backend's deserializetensor skips all bounds validation when a tensor's buffer field is 0. An unauthenticated attacker can read and write arbitrary process memory via crafted GRAPHCOMPUTE messages. Combined...

CVE-2026-33990

Docker Model Runner DMR is software used to manage, run, and deploy AI models using Docker. Prior to version 1.1.25, Docker Model Runner contains an SSRF vulnerability in its OCI registry token exchange flow. When pulling a model, Model Runner follows the realm URL from the registry's...

CVE-2026-35091

A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Corosync membership commit token sanity check by sending a specially crafted User Datagram Protocol UDP packet. This can lead to an out-of-bounds read, causing a denial of service...

Linux Distros Unpatched Vulnerability : CVE-2026-5277

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Integer overflow in ANGLE in Google Chrome on Windows prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to perform an o...

GHSA-PPP5-5V6C-4JWP vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, kubeflow-katib, kubeflow-centraldashboard, opensearch-dashboards...

GHSA-Q67F-28XG-22RW vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, kibana, opensearch-dashboards, gitlab-rails-ce, kubeflow-katib, arangodb, kubeflow-centraldashboard, opensearch-dashboards-fips, gitlab-rails-ce-fips, wazuh-dashboard, wazuh-dashboard-fips...

CVE-2026-0396

An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where domain-based dynamic rules have been enabled via either DynBlockRulesGroup:setSuffixMatchRule or DynBlockRulesGroup:setSuffixMatchRuleFFI...

CVE-2026-27853

An attacker might be able to trigger an out-of-bounds write by sending crafted DNS responses to a DNSdist using the DNSQuestion:changeName or DNSResponse:changeName methods in custom Lua code. In some cases the rewritten packet might become larger than the initial response and even exceed 65535...

CVE-2026-33809 vulnerabilities

Vulnerabilities for packages: mailpit, hugo, hugo-extended, mattermost, rclone, ollama, seaweedfs...

GHSA-87MJ-5GGW-8QC3 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-4926 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, kibana, tileserver-gl-fips, langfuse, thingsboard, saf, tileserver-gl, vitess, gemini-cli, code-server, opensearch-dashboards-fips, redisinsight, langfuse-fips, wazuh-dashboard...

GHSA-6Q6W-FF4V-HGR5 vulnerabilities

Vulnerabilities for packages: ghostscript...

CVE-2026-33983

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, progressivedecompresstileupgrade detects a mismatch via progressiverfxquantcmpequal but only emits WLogWARN, execution continues. The wrapped value 247 is used as a shift exponent, causing undefined behavior...

CVE-2026-21711

A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket UDS server operations without the required permission checks, while all comparable network paths correctly enforce them. As a result, code running under --permission without --allow-net can create and expose local IP...