CVE-2026-119285

Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in middleware/cors/utils.go strips the scheme and checks only a host suffix without requiring a dot boundary. An application configured with a wildcard-subdoma...

CVE-2026-119279

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.10, the ReadableByteBuf.readLength and ReadableByteBuf.readIntLengthEncodedNotNull methods narrowed the protocol's unsigned 8-byte length-encoded integer to...

CVE-2026-115274

Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion. JSON.decode/1 and JSON.decode!/1 convert each integer liter...

CVE-2026-59993: h2o picotls: Picotls is a TLS protocol library that allows users select different crypto backends based on their use case

Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. In affected revisions through 44bc503, when picotls is used as a client-side TLS stack, a peer can send a HelloRetryRequest followed by a spoofed Hello message that causes a null-pointer...

UBUNTU-CVE-2026-119196

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts...

UBUNTU-CVE-2026-118475

A flaw was found in Eye of GNOME. When parsing a specially crafted PNG image containing malformed color profile metadata, the application fails to validate chunk boundaries while searching for a null terminator. An attacker could trick a user into opening a malicious image, causing the applicatio...

UBUNTU-CVE-2026-119284

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.6, joserfc compact JWS deserialization calls bytes.split before enforcing the existing aggregate segment-size limits. When attacker-controlled compact serializati...

UBUNTU-CVE-2026-119285

Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in middleware/cors/utils.go strips the scheme and checks only a host suffix without requiring a dot boundary. An application configured with a wildcard-subdoma...

PT-2026-134233

Name of the Vulnerable Software and Affected Versions Kubewarden policies versions prior to 2.1.2 Description The trusted-repos-policy performs case-sensitive comparisons of an image's registry hostname against reject and allow lists, despite DNS names being case-insensitive. This allows a bypass...

PT-2026-133788

Name of the Vulnerable Software and Affected Versions Pistache versions 0.0.5 through 0.4.26 Description The SegmentTreeNode::sanitizeResource function in src/server/router.cc uses std::regex replace with the //+ expression to collapse consecutive slashes. When using libstdc++, a path containing...

PT-2026-134242

Name of the Vulnerable Software and Affected Versions TAKO AI Agent for Okta versions prior to 3.0.1-beta Description Authenticated users with a valid fctr session cookie can execute arbitrary Python code without administrator privileges. By sending a request to the 'POST /api/react/execute-scrip...

PT-2026-134174

go-xrpl is a Go implementation of the XRP Ledger protocol. In versions through the June 18, 2026 revision identified by the advisory, ParseMPTAmountBinary in internal/ledger/state/ripple state.go converts the eight-byte MPT magnitude using num.Int64 without checking that it fits in 63 bits. A...

PT-2026-134187

Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the remediation of CVE-2026-47735 leaves a cross-database authorization bypass through DuckDB table-valued I/O functions. In internal/database/sandbox.go, allowed directories uses...

PT-2026-134169

Ladybird is a truly independent web browser. Prior to 209579c96473c75bd5eba9701fcadb841a045964, FinalizationRegistry::cleanup in Libraries/LibJS/Runtime/FinalizationRegistry.cpp removed a dead record from m records, retained an iterator to the next FinalizationRecord, and then invoked...

PT-2026-134177

MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, backend video access does not enforce the visitor role's intended public-only restriction when loginEnabled=true and a visitor password is configured. The frontend filter in VideoContext.tsx is only...

PT-2026-134225

Element Call is a native Matrix video conferencing application. From 0.16.0 until 0.20.3, the standalone Element Call SPA logs the password URL query parameter. When a user submits an error report, called a rageshake, these logs are shared with the application operator. Users can therefore...

PT-2026-134206

Picsou is a self-hosted personal finance dashboard. In the affected login implementation, the /api/auth/login endpoint reveals whether a username exists through a timing discrepancy. In backend/src/main/java/com/picsou/controller/AuthController.java, AuthController.login throws...

PT-2026-134211

ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to version 3.11.2, the multipart parser in src/WebRequest.cpp frees itemBuffer and sets it to NULL when BOUNDARY OR DATA matches the closing boundary of a file part, before confirmi...

PT-2026-134236

IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated user can view and edit a resource belonging to another user without authorization. The API-key edit/update path in ApiKeyController selects records by identifier without...

PT-2026-133675

gopacket provides packet processing capabilities for Go. Prior to 1.7.2, the SCTP chunk chain in layers/sctp.go passes attacker-controlled declared lengths and counts to decodeSCTPInit, decodeSCTPShutdown, decodeSCTPError, decodeSCTPSack, and decodeSCTPParameter without checking that each chunk...