CVE-2026-63632 ONNX: Heap-Buffer-Overflow READ in Gemm Version Converter Adapter via Undersized Input Shape

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.3.0 until 1.22.0, onnx.versionconverter.convertversion can perform an out-of-bounds read in Gemm76::adaptgemm76 in onnx/versionconverter/adapters/gemm76.h when a Gemm node has input tensors with...

CVE-2026-63632

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.3.0 until 1.22.0, onnx.versionconverter.convertversion can perform an out-of-bounds read in Gemm76::adaptgemm76 in onnx/versionconverter/adapters/gemm76.h when a Gemm node has input tensors with...

EUVD-2026-60944

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.3.0 until 1.22.0, onnx.versionconverter.convertversion can perform an out-of-bounds read in Gemm76::adaptgemm76 in onnx/versionconverter/adapters/gemm76.h when a Gemm node has input tensors with...

CVE-2026-63632 ONNX: Heap-Buffer-Overflow READ in Gemm Version Converter Adapter via Undersized Input Shape

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.3.0 until 1.22.0, onnx.versionconverter.convertversion can perform an out-of-bounds read in Gemm76::adaptgemm76 in onnx/versionconverter/adapters/gemm76.h when a Gemm node has input tensors with...

ANT-2026-96NHD13X · supabase/auth · auth-bypass

auth-bypass low Severity Claude low · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-96NHD13X: Factor-type string mismatch prevents session AAL downgrade In supabase/auth, DowngradeSessionsToAAL...

libssh security update

An update is available for libssh. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list libssh is a library which implements the SSH protocol. It can be used to...

Linux Distros Unpatched Vulnerability : CVE-2026-72180

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: preserve pmdswpuffdwp on device-private PMD downgrade changenonpresenthugepmd...

RockyLinux 10 : libssh (RLSA-2026:55855)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:55855 advisory. libssh: libssh: information disclosure via short GSSAPI Curve25519 public key CVE-2026-59842 libssh: libssh: denial of service via zero advertised...

RHEL 10 : libssh (RHSA-2026:55855)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55855 advisory. libssh is a library which implements the SSH protocol. It can be used to implement client and server applications. Security Fixes: libssh:...

AlmaLinux 10 : libssh (ALSA-2026:55855)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55855 advisory. libssh: libssh: information disclosure via short GSSAPI Curve25519 public key CVE-2026-59842 libssh: libssh: denial of service via zero advertised chann...

libssh: libssh: integrity downgrade via OpenSSL AES-GCM tag verification

A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection...

JLSEC-2026-1339

A user can tell curl = 7.20.0 and = 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server --ssl-reqd on the command line orCURLOPTUSESSL set to CURLUSESSLCONTROL or CURLUSESSLALL withlibcurl. This requirement could be bypassed if the server would return a...

BIT-CONSUL-2026-19012 Authenticated denial of service in Consul Enterprise-to-Community Edition downgrade path

Consul Community Edition and Consul Enterprise 1.18.0 through 2.0.2 are vulnerable to an authenticated denial of service in the Enterprise-to-Community Edition downgrade path that may allow an authorized caller to crash the Consul server. A caller with config-entry write permission can submit a...

CVE-2026-72887

Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in getrequesttoken. Passing a callback to the constructor selects OAuth 1.0a. getrequesttoken then revokes that choice when the request token response omits...

CVE-2026-72887

Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in getrequesttoken. Passing a callback to the constructor selects OAuth 1.0a. getrequesttoken then revokes that choice when the request token response omits...

CVE-2026-72887 Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in get_request_token

Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in getrequesttoken. Passing a callback to the constructor selects OAuth 1.0a. getrequesttoken then revokes that choice when the request token response omits...

EUVD-2026-59987

Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in getrequesttoken. Passing a callback to the constructor selects OAuth 1.0a. getrequesttoken then revokes that choice when the request token response omits...

CVE-2026-72887

The Net::OAuth::Client component in Perl (versions before 0.32 ) is vulnerable to a silent downgrade from OAuth 1.0a to OAuth 1.0 during the get_request_token process. If a callback is provided to the constructor to select OAuth 1.0a, the library revokes this choice without warning if the respons...

CVE-2026-72887

Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in getrequesttoken. Passing a callback to the constructor selects OAuth 1.0a. getrequesttoken then revokes that choice when the request token response omits...

CVE-2026-72887 Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in get_request_token

Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in getrequesttoken. Passing a callback to the constructor selects OAuth 1.0a. getrequesttoken then revokes that choice when the request token response omits...