CVE-2026-76229

A flaw was found in Renovate. This arbitrary command injection vulnerability exists within the kustomize manager, where user-provided chart names are not properly sanitized before being used in helm pull commands. An attacker with write access to a repository can exploit this by crafting maliciou...

CVE-2026-70898

creationtimestamp| type| source ---|---|--- 2026-08-19 17:45:30+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...

CVE-2026-70897

creationtimestamp| type| source ---|---|--- 2026-08-19 17:45:27+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...

[SECURITY] [DSA 6451-1] firefox-esr security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6451-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff August 19, 2026 https://www.debian.org/security/faq -...

CVE-2026-55191 FreeRDP: Heap-buffer-overflow write in AVC444 YUV buffer allocation

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients that negotiate RDPGFX AVC444 with an H.264 decoder backend calculate the intermediate YUV444 allocation size in libfreerdp/codec/h264.c with 32-bit multiplication in avc444ensurebuffer. A malicious R...

CVE-2026-55191 FreeRDP: Heap-buffer-overflow write in AVC444 YUV buffer allocation

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients that negotiate RDPGFX AVC444 with an H.264 decoder backend calculate the intermediate YUV444 allocation size in libfreerdp/codec/h264.c with 32-bit multiplication in avc444ensurebuffer. A malicious R...

EUVD-2026-62660

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients that negotiate RDPGFX AVC444 with an H.264 decoder backend calculate the intermediate YUV444 allocation size in libfreerdp/codec/h264.c with 32-bit multiplication in avc444ensurebuffer. A malicious R...

CVE-2026-55191

FreeRDP clients prior to 3.27.0 are vulnerable to a heap-buffer-overflow write in the RDPGFX AVC444 codec path. In libfreerdp/codec/h264.c, the function avc444_ensure_buffer() computes the intermediate YUV444 buffer size using 32-bit multiplication (piDstStride[x] * padDstHeight). A malicious RDP...

CVE-2026-72399

A flaw was found in the Linux kernel's enetc network driver. This vulnerability occurs in the eXpress Data Path XDP frame processing, where the driver fails to properly check the number of fragments in an XDP frame against the allocated buffer size. A remote attacker could exploit this...

CVE-2026-74513

A flaw was found in the Linux kernel's dibs module. A race condition exists during the attach, detach, and unregister operations of dmbnode objects. This allows a concurrent operation to free a dmbnode while another operation attempts to access its reference count, leading to a use-after-free...

CVE-2026-74505

A flaw was found in the ALSA 6fire driver within the Linux kernel. During error handling in the probe phase, the driver failed to properly manage a pending USB Request Block URB before freeing associated resources. This oversight could lead to a Use-After-Free UAF vulnerability. A local attacker...

CVE-2026-72443

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture ALSA USB audio driver. During the handling of MIDI 2.0 input Universal Serial Bus USB Request Blocks URBs, a setup failure can lead to a use-after-free vulnerability. This allows a local attacker, or a malicious USB device, ...

CVE-2026-62682

Orval (OpenAPI client generator) versions before 8.21.0 emit an unescaped backtick from servers[0].url into generated template literals in packages/core/src/getters/route.ts (getFullRoute), allowing attacker-controlled JS execution when the generated client is invoked; fixed in 8.21.0. No exploit...

CVE-2026-62682 Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in servers0.url is emitted into request URL template literals generated when output.baseUrl.getBaseUrlFromSpecification is enabled without safe encoding...

CVE-2026-62682 Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in servers0.url is emitted into request URL template literals generated when output.baseUrl.getBaseUrlFromSpecification is enabled without safe encoding...

EUVD-2026-62657

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in a schema default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits...

CVE-2026-72717

CVE-2026-72717 is a critical (CVSS 4.0: 9.3 ) import-time remote code execution vulnerability in Orval , a tool that generates type-safe TypeScript clients from OpenAPI/Swagger specifications. The root cause is in packages/zod/src/index.ts, function formatDefaultValue: a ${...} expression or back...

CVE-2026-72717 Orval: Import-time RCE via schema default -> zod module-level template literal

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in a schema default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits...

CVE-2026-71867 Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a single quote in a schema property name is emitted into single-quoted object keys in generated MSW mock factories without safe encoding. This permits attacker-controlled...

CVE-2026-71867

Orval versions prior to 8.21.0 emit unsanitized single quotes from OpenAPI schema property names into single-quoted object keys in generated MSW mock factories (packages/core/src/getters/keys.ts), enabling attacker-controlled JavaScript evaluation and RCE in developer, CI, test, or application en...