CVE-2026-32953

Tillitis TKey Client package is a Go package for a TKey client. Versions 1.2.0 and below contain a critical bug in the tkeyclient Go module which causes 1 out of every 256 User Supplied Secrets USS to be silently ignored, producing the same Compound Device Identifier CDI—and thus the same key...

GHSA-6GX3-4362-RF54 vulnerabilities

Vulnerabilities for packages: pixi, uv, wasmcloud...

GHSA-WFV2-PWC8-CRG5 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards...

CVE-2026-30951 vulnerabilities

Vulnerabilities for packages: sqlpad...

SUSE CVE-2026-32829

lz4flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak sensitive information from uninitialized memory or from previous decompression operations. The library fails to properly validate offset values...

ROS-20260320-73-0014

Vulnerability in glpi related to a flaw in the deserialization mechanism. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code...

CVE-2026-2369

A flaw was found in libsoup. An integer underflow vulnerability occurs when processing content with a zero-length resource, leading to a buffer overread. This can allow an attacker to potentially access sensitive information or cause an application level denial of service...

GHSA-XH32-C9WX-PHRP vulnerabilities

Vulnerabilities for packages: keycloak...

CVE-2026-1525 vulnerabilities

Vulnerabilities for packages: kibana, langfuse, pelias-api, gemini-cli, librechat, code-server, jitsucom-jitsu, langfuse-fips, renovate...

CVE-2026-2046

Unknown description...

CVE-2026-23251

In the Linux kernel, the following vulnerability has been resolved: xfs: only call xfarray,blobdestroy if we have a valid pointer Only call the xfarray and xfblob destructor if we have a valid pointer, and be sure to null out that pointer afterwards. Note that this patch fixes a large number of...

GHSA-XPQW-6GX7-V673 vulnerabilities

Vulnerabilities for packages: vitess...

GHSA-JR27-M4P2-RC6R vulnerabilities

Vulnerabilities for packages: mlflow, kubeflow-pipelines, k8s-sidecar, airflow, datadog-agent, py3-cassandra-medusa, kubeflow-jupyter-web-app, kubeflow-pipelines-visualization-server, superset, kubeflow-volumes-web-app...

CVE-2026-27448 vulnerabilities

Vulnerabilities for packages: datadog-agent-fips, keep-fips, superset, authentik-fips, localstack, datadog-agent, datahub-ingestion, gitlab-cng-fips, keep, py3-cassandra-medusa, authentik, mitmproxy, awx, request-1276, az, gitlab-cng, airflow, ggshield...

CVE-2026-4359

A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the MongoDB C driver...

CVE-2026-3634

A flaw was found in libsoup. An attacker controlling the value used to set the Content-Type header can inject a Carriage Return Line Feed CRLF sequence due to improper input sanitization in the soupmessageheaderssetcontenttype function. This vulnerability allows for the injection of arbitrary...

GHSA-3936-CMFR-PM3M vulnerabilities

Vulnerabilities for packages: kserve, nemo, label-studio, open-webui...

CVE-2026-4224

When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs...

CVE-2026-3083

GStreamer rtpqdm2depay Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary dependin...

CVE-2026-2923

GStreamer DVB Subtitles Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary dependi...