CVE-2026-44227

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability. An attacker who can induce an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user's...

CVE-2026-55238

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of RDP Confirm Active PDU, where during the capability negotiation phase, the parser did not perform sufficient length validation for specific capability sets. A remote, unauthenticated...

CVE-2026-63876

In the Linux kernel, the following vulnerability has been resolved: serial: zs: Convert to use a platform device Prevent a crash from happening as the first serial port is initialised: Console: switching to mono frame buffer device 160x64 fb0: PMAG-AA frame buffer device at tc0 DECstation Z85C30...

CVE-2026-64007

In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: refresh tcphdr after skbensurewritable synproxytstampadjust rewrites the TCP timestamp option in place and then patches the TCP checksum via inetprotocsumreplace4 on the caller-supplied tcphdr pointer. Both...

GHSA-W776-5FWP-835Q vulnerabilities

Vulnerabilities for packages: linux-qemu-melange, linux-gcp, linux-qemu...

CVE-2025-71313 vulnerabilities

Vulnerabilities for packages: linux-qemu-melange...

CVE-2026-46210 vulnerabilities

Vulnerabilities for packages: linux-qemu-melange...

CVE-2026-48863

A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect length handling when copying EdDSA 's' MPI into a stack buffer. A remote attacker could craft a malicious Ed25519 PGP signature with mismatched MPI lengths. Processin...

CVE-2023-54365 vulnerabilities

Vulnerabilities for packages: kubeflow-katib...

golang: Go os.Root: Symlink following vulnerability allows directory traversal

A flaw was found in the os.Root functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in os.Root with such a path, the symbolic link is...

GHSA-V722-58F9-VCJ4 vulnerabilities

Vulnerabilities for packages: linux-qemu, linux-gcp, linux-qemu-melange, linux-azure...

CVE-2026-53253 vulnerabilities

Vulnerabilities for packages: linux-qemu, linux-gcp, linux-qemu-melange, linux-azure...

GHSA-V68W-64JW-RFJJ vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-53131 vulnerabilities

Vulnerabilities for packages: linux-aws, linux-qemu, linux-qemu-melange, linux-azure, linux-gcp, linux-vmware...

ROS-20260708-73-0055

The vulnerability in jq is related to an uncontrolled recursion. Exploiting this vulnerability can allow an attacker to cause a service failure...

pip: pip: Incorrect file installation due to improper archive handling

A flaw was found in pip. This vulnerability occurs because pip incorrectly processes concatenated tar and ZIP files as ZIP files, regardless of their true format. This improper handling can lead to confusing installation behavior, potentially causing the installation of unintended or 'incorrect'...

ROS-20260707-73-0009

The vulnerability in jq is related to integer overflow. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-55380

Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile.open read image dimensions from the GD 2.x header and stored them in self.size without calling Image.decompressionbombcheck, allowing a crafted .gd file to trigger excessive C-heap allocation when loaded. This iss...

CVE-2026-8924

A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains...

CVE-2026-54886

Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Erlang OTP ssh sshsftpd module allows an authenticated SFTP user to render an SFTP channel permanently unresponsive. The handledata/4 function in sshsftpd contains a catch-all clause that accepts channel data of any type. When...