198131 matches found
GO-2026-6507 vulnerabilities
Vulnerabilities for packages: kubernetes-dns-node-cache, k8sgateway, juicefs...
CVE-2026-102925
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate bash and zsh and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path...
CVE-2026-102904
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.0.0 until 4.5.11 and 4.6.4, the PyPI Extension Manager uninstall request reaches ExtensionHandler.post, which validates extension names for installatio...
gawk: gawk: Memory corruption via integer overflow
A flaw was found in gawk. An integer overflow vulnerability could allow a local attacker to cause memory exhaustion, leading to a denial of service. This flaw may also enable an attacker to corrupt gawk's internal memory, potentially leading to system instability...
gdb: gdb: Out-of-bounds write in STABS parser read_member_functions() via crafted ELF
A flaw was found in GDB's STABS debug format parser. The readmemberfunctions function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in the main functio...
gawk: gawk: Memory corruption via integer overflow
A flaw was found in gawk. An integer overflow vulnerability could allow a local attacker to cause memory exhaustion, leading to a denial of service. This flaw may also enable an attacker to corrupt gawk's internal memory, potentially leading to system instability...
CVE-2026-102620
A vulnerability was determined in Freedesktop Poppler 26.06.0/26.07.0/26.08.0. This impacts the function FoFiTrueType::cvtSfnts of the file fofi/FoFiTrueType.cc. This manipulation causes integer overflow. The attack can only be executed locally. The exploit has been publicly disclosed and may be...
undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation
A flaw was found in undici. When the cache or deduplicate interceptor is directly composed onto a Client or Pool, the destination origin is omitted from cache and request-deduplication keys. This allows a remote attacker to perform cross-origin cache poisoning, leading to information disclosure a...
CVE-2026-67987
crmne/rubyllm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains polynomial-time regular expression denial-of-service conditions in think-tag response parsing on Ruby 3.1.x. A malicious or anomalous model response containing many unterminated tags can cause excessive CPU consumption in t...
CVE-2026-102253
iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter message followed by one 16-byte UDP datagra...
CVE-2026-97927
A flaw was found in the Linux kernel's Unix File System UFS implementation. This vulnerability allows a local user to cause a Denial of Service DoS by mounting a specially crafted or corrupted file system image. During a failed mount operation, an improper cleanup sequence leads to a null pointer...
CVE-2026-97926
A flaw was found in the Linux kernel's Unix File System UFS driver. When reading filesystem metadata from storage, the driver fails to validate cylinder group indices and rotor positions before caching them. A local attacker capable of mounting a specially crafted filesystem image could exploit...
CVE-2026-102330
Incorrect authorization in SiteIsolation in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...
CVE-2026-102314
UI misrepresentation in TabStrip in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to spoof UI elements via a crafted HTML page. Chromium security severity: Low...
CVE-2026-102321
Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-102302
Buffer overflow in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-102320
Missing authorization in CORS in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-102308
Use after free in Views in Google Chrome prior to 154.0.8037.92 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-102319
Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. Chromium security severity: High...