GHSA-X94W-CG8G-G593 vulnerabilities

Vulnerabilities for packages: libssh...

GHSA-MQ2J-7VQ4-77M8 vulnerabilities

Vulnerabilities for packages: libssh...

GHSA-X5CR-V39M-53GW vulnerabilities

Vulnerabilities for packages: libssh...

CVE-2026-59850 vulnerabilities

Vulnerabilities for packages: libssh...

CVE-2026-59845 vulnerabilities

Vulnerabilities for packages: libssh...

CVE-2026-59846 vulnerabilities

Vulnerabilities for packages: libssh...

GHSA-FVWJ-J79Q-57V7 vulnerabilities

Vulnerabilities for packages: libssh...

CVE-2026-59847 vulnerabilities

Vulnerabilities for packages: libssh...

GHSA-6J7F-8JJP-MM8C vulnerabilities

Vulnerabilities for packages: libssh...

CVE-2026-73418 NextAuth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken helper in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when it reads a malformed Authorization: Bearer header. When no session...

CVE-2026-62420

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. When moving an instance cross-project to a different cluster member via POST /1.0/instances/name with migration: true, project: ,...

CVE-2026-19642

An out-of-bounds write issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862 might allow a remote authenticated user to cause a crash or heap memory corruption in an application that processes crafted Base64-encoded input. To remediate this issue, users should upgrade to version...

CVE-2026-11932 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 is vulnerable to a denial of service attack...

EUVD-2026-57548

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 is vulnerable to a denial of service attack...

CVE-2026-11937

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 and IBM Security Verify Access Container 10.0 through 10.0.9.2 Reverse Proxy in certain configurations is vulnerable to a denial of...

JLSEC-2026-1270

Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, when using Transfer-Encoding: chunked, if a chunk's size parsed to a value of 2^64 or larger, it would be truncated to a 64-bit integer. In theory, this bug could enable HTTP request/response smuggling. This...

SIPSorcery: Malformed UDP datagram crashes TurnServer receive loop with no restart, disabling TURN UDP relay for all clients (DoS)

Summary TurnServer.ReceiveUdpAsync places its generic catch Exception OUTSIDE the while receive loop, and Start launches the loop fire-and-forget with no supervision or restart. A single pre-authentication UDP datagram whose STUN header first byte is in 0x80–0xFF causes STUNHeader.ParseSTUNHeader...

SIPSorcery vulnerable to Denial of Service via out-of-bounds read in SCTP SACK chunk parsing

Summary SctpSackChunk.ParseChunk reads the numGapAckBlocks and numDuplicateTSNs fields each up to 65535 directly from an attacker-controlled SCTP SACK chunk and loops that many times reading 4 bytes per iteration, with no validation of the counts against the chunk length or the receive buffer. A...

CVE-2026-18675

The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs. The panic terminates the entire kuma-cp process,...

EUVD-2026-57421

The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs. The panic terminates the entire kuma-cp process,...