EUVD-2026-72386

commonmark versions from 1.5.0 before 2.10.0 contain a denial of service vulnerability in the AttributesExtension when processing distinctly-named attributes. Attackers can submit Markdown with numerous distinct attribute names to cause quadratic-time attribute merging and filtering, consuming...

CVE-2026-86428 commonmark 1.5.0 before 2.10.0 Denial of Service via Attributes

commonmark versions from 1.5.0 before 2.10.0 contain a denial of service vulnerability in the AttributesExtension when processing distinctly-named attributes. Attackers can submit Markdown with numerous distinct attribute names to cause quadratic-time attribute merging and filtering, consuming...

CVE-2026-86428

PHP League CommonMark (versions 1.5.0 through before 2.10.0 ) is affected by a denial-of-service vulnerability in the AttributesExtension . When processing Markdown containing numerous distinctly-named attributes, the extension performs quadratic-time attribute merging and filtering , consuming d...

UBUNTU-CVE-2026-78132

strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin's attribute certificate parser for ietfAttrSyntax...

UBUNTU-CVE-2026-78130

strongSwan 4.2.0 through 6.0.7 has a NULL pointer dereference in the x509 plugin's attribute certificate parser...

CVE-2026-78132

strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin's attribute certificate parser for ietfAttrSyntax...

CVE-2026-78130

strongSwan 4.2.0 through 6.0.7 has a NULL pointer dereference in the x509 plugin's attribute certificate parser...

CVE-2026-78131

strongSwan 4.2.0 through 6.0.7 has a missing release of memory after its effective lifetime in the x509 plugin's attribute certificate parser...

UBUNTU-CVE-2026-78131

strongSwan 4.2.0 through 6.0.7 has a missing release of memory after its effective lifetime in the x509 plugin's attribute certificate parser...

K000163173: Linux kernel MRP vulnerability CVE-2026-53245

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: net/802/mrp: fix vector attribute parsing in mrppduparsevecattr In mrppduparsevecattr, vector attribute events are encoded three per byte and valen tracks the number of events left to process. The...

PT-2026-89677

Name of the Vulnerable Software and Affected Versions strongSwan versions 4.2.0 through 6.0.7 Description A NULL pointer dereference exists in the x509 plugin's attribute certificate parser. This issue is network exploitable and requires no authentication, potentially leading to a Denial of Servi...

PT-2026-89738

Name of the Vulnerable Software and Affected Versions strongSwan versions 5.1.3 through 6.0.7 Description An infinite loop exists in the x509 plugin's attribute certificate parser when processing ietfAttrSyntax. This issue can lead to a Denial of Service DoS and is exploitable over the network...

PT-2026-89737

Name of the Vulnerable Software and Affected Versions strongSwan versions 4.2.0 through 6.0.7 Description A memory leak occurs in the x509 plugin's attribute certificate parser, where memory is not released after its effective lifetime. Recommendations Update strongSwan to a version later than...

Linux Distros Unpatched Vulnerability : CVE-2026-86428

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - commonmark versions from 1.5.0 before 2.10.0 contain a denial of service vulnerability in the AttributesExtension when processing distinctly-named attributes...

Linux Distros Unpatched Vulnerability : CVE-2026-80869

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the attribute-list entry in ntfsreadinodemount The $MFT attribute-list walk in...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass via improper handling of the Set-Cookie header when the Domain attribute matches a public suffix. An attacker can cause cookies to be sent to arbitrary sibling subdomains by setting a cookie with a domain scope tha...

CVE-2026-80255

The curl utility incorrectly handles the Set-Cookie: header when a horizontal tab (ASCII code 9) is used instead of a space (ASCII code 32) before the Secure attribute. This parsing error causes curl to store the cookie without the Secure flag, potentially leading to the cookie being transmitted ...

CVE-2026-80255 secure cookie attribute bypass with tab

A Set-Cookie: header using tab horizontal tab, ASCII code 9 instead of space ascii code 32 immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host...

CVE-2026-80255 secure cookie attribute bypass with tab

A Set-Cookie: header using tab horizontal tab, ASCII code 9 instead of space ascii code 32 immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host...

libxml2: double-free/UAF in libxml2 Python bindings

A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition DTD with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callbac...